EUVD-2026-42804
GHSA-gfch-rpr6-7jf3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS is network-exploitable with no attacker privileges, but requires victim interaction (UI:R); injected script crosses into browser context causing scope change (S:C).
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.1.77 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected Cross-Site Scripting in the Brevo (formerly Sendinblue) Newsletter, SMTP, Email marketing and Subscribe forms WordPress plugin allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers through a crafted URL containing a malicious payload in the page parameter. All plugin versions up to and including 3.1.77 are affected, with the root flaw traced to insufficient input sanitization and output escaping in inc/table-forms.php at line 102. No active exploitation has been confirmed in CISA KEV, and no POC code is identified in the provided data, though the CVSS scope-change rating (S:C) elevates the effective impact beyond the plugin's own context.
Technical ContextAI
This is a CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) vulnerability in the reflected variant: user-supplied input from the page URL parameter is incorporated into the HTTP response without adequate sanitization or HTML-context-aware output escaping. The vulnerable code is located at inc/table-forms.php#L102 in the WordPress plugin slug mailin. WordPress plugins execute within the PHP runtime of the hosting CMS, meaning injected scripts execute under the victim's authenticated WordPress session context if the victim is logged in - enabling session hijacking, admin takeover, or credential theft. The CVSS scope change (S:C) reflects that the injected payload escapes the plugin's trust boundary and operates in the victim's browser security context.
RemediationAI
Site administrators should update the Brevo plugin immediately to any version released after 3.1.77. A fix commit has been identified in the WordPress.org SVN repository (changeset 3055756 relative to 3032712 in the mailin trunk, available at the provided trac changeset URL), confirming that upstream code has been patched; however, the exact release version number of the patched build is not explicitly stated in the available data and should be verified via the WordPress plugin dashboard or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bf4cb79e-e62b-4991-8ee5-493dafe38b80. As a compensating control if immediate patching is not possible, sites can install a web application firewall rule (e.g., Wordfence's built-in firewall, which may already block this reflected XSS pattern for premium users) to filter malicious payloads in the page parameter - note this does not fix the underlying flaw and must be maintained separately. Additionally, educating users with administrative access about link-clicking hygiene reduces the social engineering surface required to trigger this vulnerability.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today