CVE-2021-24874: Brevo Newsletter, Smtp, Email Marketing And Subscribe

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Affected products

• Brevo Newsletter, Smtp, Email Marketing And Subscribe: before 3.1.31 (fixed in 3.1.31)

Published 2022-02-14. Last modified 2026-06-17.