blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24528

MEDIUM 5.4 CVSS 3.1
Published
August 30, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.

Affected WordPress components

  • FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP Plugin · fluent-smtp
    Confirmed match Active
    From 2.0.1 (including) to 2.0.1 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown FluentSMTP – WordPress Mail SMTP, SES, SendGrid, Mailgun and Any SMTP Plugin — From 2.0.1 (including) to 2.0.1 (excluding)
  • wpmanageninja fluentsmtp — Before 2.0.1

References

  • wpscan.com https://wpscan.com/vulnerability/8b8d316b-96b2-4cdc-9da5-c9ea6108a85b Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record