What’s Vulnerable › Vulnerabilities

CVE-2021-28975

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-10-21 · updated 2026-06-17
• Weakness: CWE-79

Description

WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name, or connection_parameter parameter.

Affected products

• brandtoss WP Mailster: 1.6.18

References

• https://www.compass-security.com/en/research/advisories/
• https://www.compass-security.com/fileadmin/Research/Advisories/2021-18_CSNC-2021-018-WPMailster_XSS_CSRF.txt
• https://www.compass-security.com/en/research/advisories/
• https://www.compass-security.com/fileadmin/Research/Advisories/2021-18_CSNC-2021-018-WPMailster_XSS_CSRF.txt

Get alerted when CVE-2021-28975 or the next vulnerability affects your stack