CVE-2024-35668: Brevo Newsletter Plugin XSS Vulnerability

CVE-2024-35668 Overview

CVE-2024-35668 is a reflected Cross-Site Scripting (XSS) vulnerability in the Brevo (formerly Sendinblue) Newsletter, SMTP, Email marketing and Subscribe forms plugin for WordPress. The flaw affects all plugin versions up to and including 3.1.77. The plugin fails to properly neutralize user-controlled input during web page generation, allowing attackers to inject arbitrary JavaScript that executes in a victim's browser session. The vulnerability is classified under CWE-79 and requires user interaction, typically through a crafted link. Successful exploitation can lead to session token theft, credential harvesting, or unauthorized actions performed under the victim's WordPress identity.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser of any user who clicks a crafted link, enabling session hijacking, phishing, and administrative account compromise when a WordPress admin is targeted.

Affected Products

Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue — versions up to and including 3.1.77
WordPress installations using the affected plugin
Any site administrator or visitor session exposed to attacker-controlled URLs targeting the plugin

Discovery Timeline

2024-06-04 - CVE-2024-35668 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35668

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Brevo WordPress plugin. Reflected XSS occurs when an application echoes attacker-supplied input into an HTTP response without proper encoding or sanitization. In this case, the plugin processes request parameters and renders them back into the generated page without applying context-appropriate output escaping.

An attacker crafts a URL containing malicious JavaScript in a vulnerable parameter and delivers it to a victim through phishing or a malicious webpage. When the victim clicks the link while browsing the affected WordPress site, the injected payload executes in the browser under the site's origin. The attack scope is changed, meaning the payload can affect resources beyond the vulnerable component, including cookies scoped to the WordPress domain.

Root Cause

The root cause is missing or insufficient output encoding in the plugin's request-handling logic. The plugin reflects user-controlled parameters into HTML output without escaping characters such as <, >, ", and '. This aligns with the classic CWE-79 pattern of improper neutralization of input during web page generation.

Attack Vector

The attack requires no authentication but does require user interaction. An attacker constructs a URL targeting a vulnerable endpoint on a WordPress site running the affected plugin. The URL contains a JavaScript payload in a reflected parameter. When a victim clicks the link, their browser sends the request and renders the response, executing the payload in the site's security context.

See the Patchstack Vulnerability Report for additional technical context. No public proof-of-concept exploit code is available at the time of publication.

Detection Methods for CVE-2024-35668

Indicators of Compromise

HTTP GET requests to plugin endpoints containing URL-encoded HTML tags such as %3Cscript%3E, onerror=, or javascript: in query parameters
Web server access logs showing referrer headers from external domains delivering crafted URLs to plugin paths
Unexpected outbound requests from admin browsers to attacker-controlled domains following link clicks
WordPress admin session anomalies such as new administrator accounts, plugin changes, or unauthorized content modifications

Detection Strategies

Inspect WordPress plugin inventories for the Brevo plugin at version 3.1.77 or earlier
Deploy web application firewall (WAF) rules that flag reflected script payloads in requests targeting /wp-content/plugins/mailin/ paths
Correlate suspicious inbound URL patterns with subsequent administrative actions in WordPress audit logs
Monitor browser telemetry on privileged workstations for JavaScript execution originating from unexpected referrers

Monitoring Recommendations

Enable verbose HTTP access logging on the WordPress reverse proxy or web server to capture full query strings
Aggregate WordPress and web server logs into a centralized analytics platform for correlation and retention
Configure alerts on WordPress user role changes, plugin installations, and settings modifications following external referrer traffic
Track outbound DNS queries from administrator endpoints to identify beaconing that follows an XSS-triggered payload

How to Mitigate CVE-2024-35668

Immediate Actions Required

Update the Brevo Newsletter, SMTP, Email marketing and Subscribe forms plugin to a version later than 3.1.77
Audit WordPress administrator accounts for unauthorized additions or privilege changes
Force password resets and revoke active sessions for privileged users if suspicious activity is observed
Review recent plugin, theme, and content changes for signs of tampering

Patch Information

The vulnerability affects the plugin from unspecified earlier versions through 3.1.77. Administrators should upgrade to the latest available release from the WordPress plugin repository. Refer to the Patchstack Vulnerability Report for advisory details and fixed version guidance.

Workarounds

Deactivate and remove the Brevo plugin until an upgrade can be applied
Deploy WAF rules to block requests containing script tags or event handler attributes in query parameters targeting plugin endpoints
Enforce a strict Content Security Policy (CSP) that restricts inline script execution on WordPress admin and public pages
Require administrators to access WordPress from dedicated browsers or profiles that do not follow untrusted links

bash

# Example WAF rule (ModSecurity) to block reflected script payloads targeting the plugin
SecRule REQUEST_URI "@contains /wp-content/plugins/mailin/" \
    "chain,phase:2,deny,status:403,id:1035668,\
    msg:'Potential CVE-2024-35668 reflected XSS attempt against Brevo plugin'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"