CVE-2021-4350
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfm_send_file_in_email AJAX action. This makes it possible for unauthenticated attackers to send emails using the site with a custom subject, recipient email, and body with unsanitized HTML content. This effectively lets the attacker use the site as a spam relay.
We have discovered 14 live websites that are affected by CVE-2021-4350.
Affected Software
| Product |  Nmedia User File Uploader |
| Category | Wordpress Plugins |
| Vulnerable Domains | 14 live websites (100% of Nmedia User File Uploader install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 1 versions ( 100% of all versions) |
Details
- Published - Jun 7, 2023
- Updated - Dec 28, 2024
Credits
- Jerome Bruandet (finder)
CVE References
Website Distribution by Country
Number of websites using CVE-2021-4350 United States | 5 websites |
 Italy | 2 websites |
 Russia | 2 websites |
 Australia | 1 websites |
 Colombia | 1 websites |
 Greece | 1 websites |
 Netherlands | 1 websites |
 Vietnam | 1 websites |
Website Distribution by TLD
Number of websites using CVE-2021-4350| .com | 4 websites |
| .it | 2 websites |
| .com.au | 1 websites |
| .nl | 1 websites |
| .org | 1 websites |
| .ru | 1 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2021-4350
Top websites that are affected by CVE-2021-4350. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ******.org | United States | *,***,*** | |
| *************.com | United States | *,***,*** | |
| *****.ru | Russia | **,***,*** | |
| ***********.com | United States | **,***,*** | |
| ********.biz | Russia | **,***,*** | |
| *************.nl | Netherlands | **,***,*** | |
| ***********.***.vn | Vietnam | **,***,*** | |
| **************.com | United States | **,***,*** | |
| ************.com | United States | **,***,*** | |
| *****.it | Italy | **,***,*** |
FAQ
A total of 14 websites have been identified as vulnerable to CVE-2021-4350, based on global website indexing conducted by WebTechSurvey.
The Nmedia User File Uploader is affected by the CVE-2021-4350 vulnerability.
Nmedia User File Uploader versions up to 18.3 are vulnerable to CVE-2021-4350.
CVE-2021-4350 is resolved in version 18.3 of Nmedia User File Uploader.