Mail Mint <= 1.19.2 - Cross-Site Request Forgery vers Cross-Site Scripting stocké

Successful exploitation of CVE-2026-1447 could allow an attacker to inject malicious JavaScript code into the Mail Mint plugin's database. This code could then be executed in the browsers of any user who views a page containing the injected script, such as a site administrator reviewing contact notes. The attacker could steal session cookies, redirect users to phishing sites, or deface the website. The stored nature of the XSS means the attack persists until the vulnerability is patched, potentially impacting a large number of users over time.

Websites using the Mail Mint plugin, particularly those with site administrators who are not vigilant about clicking on suspicious links, are at risk. Shared hosting environments where multiple websites share the same server resources could also be affected if one site is compromised.

• wordpress / composer / npm:

grep -r "create_or_update_note" /var/www/html/wp-content/plugins/mail-mint/

• wordpress / composer / npm:

wp plugin list --status=active | grep mail-mint

• wordpress / composer / npm:

wp plugin update mail-mint --all

1. 2026-02-03Disclosure

   disclosure

1. Réservé2026-01-26
2. Publiée2026-02-03
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-1447 is to upgrade the Mail Mint plugin to version 1.19.3 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the createorupdate_note function that lack proper nonce validation. Additionally, carefully review any contact notes created or modified around the time of the vulnerability disclosure for signs of malicious code. After upgrading, confirm the vulnerability is resolved by attempting to create a contact note with a crafted request and verifying that the script is not executed.

Installations actives

5KConnu

Note du plugin