Vulnerabilities

TI-2024-01975 CVE-2024-2125 · GHSA-85jh-9232-5897

EnvíaloSimple: Email Marketing y Newsletters <= 2.3 - Cross-Site Request Forgery to Arbitrary File Upload

MEDIUM 40

The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00414 Published 2024-04-09 No fix listed CWE-434

TI-2023-28068 CVE-2023-51414 · GHSA-6p7c-wj96-hf8h

WordPress EnvíaloSimple Plugin <= 2.1 is vulnerable to PHP Object Injection

MEDIUM 43

Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00565 Published 2023-12-29 No fix listed CWE-502

Vulnerabilities

Filters

EnvíaloSimple: Email Marketing y Newsletters <= 2.3 - Cross-Site Request Forgery to Arbitrary File Upload

WordPress EnvíaloSimple Plugin <= 2.1 is vulnerable to PHP Object Injection