CVE-2024-12743: 
WordPress vulnerability analysis and mitigation

The MailPoet WordPress plugin before version 5.5.2 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-12743. The vulnerability was discovered and disclosed on May 15, 2025, affecting WordPress installations using the MailPoet plugin (WPScan, NVD).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. It has been assigned a CVSS score of 4.8 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The issue can be exploited by creating a new email, deleting all blocks, and manipulating Header and Footer blocks with specific malicious content (Wiz).

When exploited, this vulnerability allows administrators to perform stored Cross-Site Scripting attacks, potentially affecting other users in the system, particularly in multisite WordPress installations where unfiltered_html capability is typically restricted (WPScan).

The vulnerability requires high privileges (administrator access) to exploit and user interaction for successful execution. The attack complexity is considered low, making it relatively straightforward for authenticated administrators to exploit (NVD).

The vulnerability has been patched in MailPoet version 5.5.2. Users are advised to update to this version or later to mitigate the risk (WPScan).