Wemail
Monthly
Reflected Cross-Site Scripting in the weMail WordPress plugin (versions before 2.1.3) lets unauthenticated attackers inject arbitrary JavaScript by luring any logged-in user to a crafted URL, because a user-supplied parameter is reflected unescaped into an HTML attribute on an AJAX endpoint that lacks nonce protection. Successful exploitation runs script in the victim's authenticated browser session - including administrators - enabling session/account takeover of the WordPress site. Publicly available exploit code exists (WPScan), though EPSS is low (0.21%) and there is no evidence of active exploitation.
Missing Authorization vulnerability in weDevs weMail.14.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected Cross-Site Scripting in the weMail WordPress plugin (versions before 2.1.3) lets unauthenticated attackers inject arbitrary JavaScript by luring any logged-in user to a crafted URL, because a user-supplied parameter is reflected unescaped into an HTML attribute on an AJAX endpoint that lacks nonce protection. Successful exploitation runs script in the victim's authenticated browser session - including administrators - enabling session/account takeover of the WordPress site. Publicly available exploit code exists (WPScan), though EPSS is low (0.21%) and there is no evidence of active exploitation.
Missing Authorization vulnerability in weDevs weMail.14.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.