CVE-2021-24528: FluentSMTP < 2.0.1 - Authenticated Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-30 · updated 2026-06-17
Weakness: CWE-79

Description

The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.

Affected products

techjewel FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider: before 2.0.1 — fixed in 2.0.1

How to fix

Upgrade to a fixed version: techjewel FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider 2.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24528 or the next vulnerability affects your stack