WordPress Plugin Vulnerabilities

WP HTML Mail < 2.9.1 - HTML Injection

Description

The WordPress Email Template Designer – WP HTML Mail WordPress plugin was affected by a HTML Injection security vulnerability.

Affects Plugins

Plugin icon
wp-html-mail
Fixed in 2.9.1

References

CVE
CVE-2019-25144
CVE
CVE-2019-25148
URL
https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection/

Miscellaneous

Original Researcher
Jerome Bruandet
Verified
No
WPVDB ID
5b81ac59-29a3-402b-97ae-07a5ef30be1a

Timeline

Publicly Published
2019-10-25 (about 6 years ago)
Added
2019-10-25 (about 6 years ago)
Last Updated
2023-06-08 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Myriad 2.0 - dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download
Published
2020-02-05
Title
Events Manager Pro < 2.6.7.2 - CSV Injection
Published
2018-07-06
Title
Ninja Forms < 3.3.9 - Insufficient Restrictions during Export Personal Data requests
Published
2014-08-01
Title
WordPress <= 2.0.2 - Remote Shell Injection
Published
2025-02-17
Title
Uncode < 2.9.1.7 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed