CVE-2019-11843

6.1 mediumEPSS 1.8%

Medium (6.1) in automattic mailpoet. EPSS 1.8% chance of exploitation in the next 30 days.

The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2020-06-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

automattic:mailpoet

References

https://github.com/mailpoet/mailpoet/releases/tag/3.23.2
https://pluginarchive.com/wordpress/mailpoet/v/3-23-2
https://wordpress.org/plugins/mailpoet/#developers
https://github.com/mailpoet/mailpoet/releases/tag/3.23.2
https://pluginarchive.com/wordpress/mailpoet/v/3-23-2

Check your stack JSON