Threats tagged 'ghsa-vg34-wjj2-chfw'

The Essential Real Estate WordPress plugin versions before 5.3.5 contain a vulnerability that allows unauthenticated users to send emails to arbitrary recipients. This occurs because the plugin does not restrict the recipient of one of its contact email actions, enabling attackers to control the sender header and message body.