CVE-2019-25144 - CVE House

Back to Database

Status published Medium CVE-2019-25144

WP HTML Mail < 2.2.11 - HTML injection

5.4 CVSS

Vulnerability Description

The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator into performing an action such as clicking on a link.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-25144

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Jerome Bruandet

References

More from a3rev

View All →

a3 Lazy Load <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Contact Us Page – Contact People <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter

Page View Count 2.8.0 - 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

Product Sort and Display for WooCommerce <= 2.4.1 - Missing Authorization

Compare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting

Affected Vendor

a3rev

View all reports →

Affected Software

WP Email Template

Vulnerable Versions:

0

Timeline

Official Publish: June 7th, 2023

Last Modified: April 8th, 2026

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement