TI-2024-23537 Aliases CVE-2024-35668 GHSA-q59j-865p-4rmj

Cross-site scripting in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by…

LOW 31CWE-79Published 2024-06-04 · Updated 2026-04-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue allows Reflected XSS.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.77.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00288 21st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Brevo	Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue	up to 3.1.77	—	No fix listed	CNA

Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue VendorBrevo Affected up to 3.1.77 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:brevo:newsletter\,_smtp\,_email_marketing_and_subscribe::::::wordpress::*	before 3.1.78	Vulnerable	Brevo

cpe:2.3:a:brevo:newsletter\,_smtp\,_email_marketing_and_subscribe:*:*:*:*:*:wordpress:*:* Versions before 3.1.78 Vulnerable ·Brevo

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-35668
2026-10-03 Alias added: GHSA-q59j-865p-4rmj

References

Advisory 1

https://patchstack.com/database/vulnerability/mailin/wordpress-newsletter-smtp-email-marketing-and-subscribe-forms-by-brevo-plugin-3-1-77-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

TI-2023-02321 Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.61 - Reflected XSS CVSS 3.1MEDIUM 6.1
TI-2021-07203 Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS CVSS 3.1MEDIUM 6.1
TI-2021-07156 Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.31 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
TI-2024-07859 Cross-site request forgery in neeraj_slit Brevo – Email, SMS, Web Push, Chat, and more. CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences