smub Vulnerabilities and Affected Products
Vulnerabilities associated with Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more.
Products
Clear product- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy15 vulnerabilities
- Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More8 vulnerabilities
- All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic7 vulnerabilities
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery7 vulnerabilities
- Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More6 vulnerabilities
- WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More6 vulnerabilities
- Sydney Toolbox5 vulnerabilities
- aThemes Addons for Elementor4 vulnerabilities
- ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)4 vulnerabilities
- Custom Twitter Feeds – A Tweets Widget or X Feed Widget3 vulnerabilities
- Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers3 vulnerabilities
- Smash Balloon Social Photo Feed – Easy Social Feeds Plugin3 vulnerabilities
- UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds3 vulnerabilities
- Contact Form & SMTP Plugin for WordPress by PirateForms2 vulnerabilities
- Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more2 vulnerabilities
- Feeds for YouTube (YouTube video, channel, and gallery plugin)2 vulnerabilities
- Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More2 vulnerabilities
- WP Mail Logging2 vulnerabilities
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More2 vulnerabilities
- aThemes Starter Sites1 vulnerability
- Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More1 vulnerability
- PDF Embedder1 vulnerability
- Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation1 vulnerability
- Slider by Soliloquy – Responsive Image Slider for WordPress1 vulnerability
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UIThe Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administ… CWE-257Jun 13, 2024 | CVSS2.7v3.1 | EPSS0.333% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2019-25141CRITICAL | Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options UpdateThe Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts. | CVSS9.8v3.1 | EPSS4.5% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |