Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue), CVE-2021-24874

CVE, Research URL: CVE-2021-24874
Home page URL: Security reports for Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue)
Application: Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue)
Published on: Feb 14, 2022
Research Description: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Affected versions: max 3.1.31.
Status: vulnerable