漏洞描述
WordPress Email Template Designer WP HTML Mail allows stored cross-site scripting through an unprotected REST-API endpoint.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.wordfence.comhttps://www.wordfence.com/blog/2022/01/unauthenticated-xss-vulnerability-patched-in-html-email-template-designer-plugin/↗wordpress.orghttps://wordpress.org/plugins/wp-html-mail/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-0218↗plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset/2656984/wp-html-mail/trunk/includes/class-template-designer.php↗github.comhttps://github.com/ARPSyndicate/cvemon↗