Low severity · published Apr 26, 2024
CVE-2024-3076
The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make…
3.8
CVSS
0.2%
EPSS
No
On KEV
Description
The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Mm-email2image · Mmilan81
through 0.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3076
Exploit
https://wpscan.com/vulnerability/617ec2e9-9058-4a93-8ad4-7ecb85107141/
More from Mm-email2image
8.1
CVE-2024-3075
The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is…