CVE-2021-47870
GetSimple CMS My SMTP Contact Plugin 1.1.2 - Stored XSS
- State
- Published
- Severity
- 4.8 Medium
- Published
- Jan 21, 2026
- Updated
- May 12, 2026
- Reserved
- Jan 18, 2026
Description
GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin attempts to sanitize user input using htmlspecialchars(), but this can be bypassed by passing dangerous characters as escaped hex bytes. This allows attackers to inject arbitrary client-side code that executes in the administrator's browser when visiting a malicious page.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Stored Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
My SMTP Contact PluginGetSimple CMS |
|
References
- Full Disclosure Repositorytechnical-descriptionexploit
- Vendor Homepageproduct
- GetSimple CMS GitHub Repositoryproduct
- ExploitDB-49798exploit
- VulnCheck Advisory: GetSimple CMS My SMTP Contact Plugin 1.1.2 - Stored XSSthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.