CVE-2022-0218 Scanner
Detects 'Cross-Site Scripting (XSS)' vulnerability in WP HTML Mail plugin for WordPress affects v. 3.0.9 and before.
Used 2k times · 3.3k assets checked · url
CVE
CVE-2022-0218
6.1
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
wp html mail
Updated Sep 26, 2026View on NVD →
S4E scanner
CVE history: wp html mail
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →