CVE-2019-25148
Last modified
CVE-2019-25148 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.9.0.3 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator into performing an action such as clicking on a link.. EPSS estimates a 0.75% chance of exploitation in the next 30 days.
Description
The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.9.0.3 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator into performing an action such as clicking on a link.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Codemiq | Wp Html Mail | < 2.9.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-25148?
How severe is CVE-2019-25148?
How do I fix CVE-2019-25148?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-25142The Mesmerize & Materialis themes for WordPress are vulnerab…8.8
- CVE-2019-25143The GDPR Cookie Compliance plugin for WordPress is vulnerabl…4.3
- CVE-2019-25144The WP HTML Mail plugin for WordPress is vulnerable to HTML …6.1
- CVE-2019-25145The Contact Form & SMTP Plugin by PirateForms plugin for Wor…6.1
- CVE-2019-25146The DELUCKS SEO plugin for WordPress is vulnerable to Stored…6.1
- CVE-2019-25147The Pretty Links plugin for WordPress is vulnerable to Store…6.1
- CVE-2019-25149The Gallery Images Ape plugin for WordPress is vulnerable to…4.3
- CVE-2019-25150The Email Templates plugin for WordPress is vulnerable to HT…8.8
- CVE-2019-25151The Funnel Builder plugin for WordPress is vulnerable to aut…4.3
- CVE-2019-25152The Abandoned Cart Lite for WooCommerce and Abandoned Cart P…6.1
- CVE-2019-25154Inappropriate implementation in iframe in Google Chrome prio…9.6
- CVE-2019-25155DOMPurify before 1.0.11 allows reverse tabnabbing in demos/h…6.1
Are you affected by CVE-2019-25148?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST