Wemail
Monthly
Reflected Cross-Site Scripting in the weMail WordPress plugin (versions before 2.1.3) lets unauthenticated attackers inject arbitrary JavaScript by luring any logged-in user to a crafted URL, because a user-supplied parameter is reflected unescaped into an HTML attribute on an AJAX endpoint that lacks nonce protection. Successful exploitation runs script in the victim's authenticated browser session - including administrators - enabling session/account takeover of the WordPress site. Publicly available exploit code exists (WPScan), though EPSS is low (0.21%) and there is no evidence of active exploitation.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs weMail allows Retrieve Embedded Sensitive Data.14.13. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows DOM-Based XSS.14.5. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in weDevs weMail.14.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected Cross-Site Scripting in the weMail WordPress plugin (versions before 2.1.3) lets unauthenticated attackers inject arbitrary JavaScript by luring any logged-in user to a crafted URL, because a user-supplied parameter is reflected unescaped into an HTML attribute on an AJAX endpoint that lacks nonce protection. Successful exploitation runs script in the victim's authenticated browser session - including administrators - enabling session/account takeover of the WordPress site. Publicly available exploit code exists (WPScan), though EPSS is low (0.21%) and there is no evidence of active exploitation.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs weMail allows Retrieve Embedded Sensitive Data.14.13. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows DOM-Based XSS.14.5. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in weDevs weMail.14.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.