CVE-2021-24874

CVE-2021-24874 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin prior to version 3.1.31. This medium severity vulnerability (CVSS 6.1) arises from improper escaping of the 'lang' and 'pid' parameters before outputting them, allowing an attacker to inject malicious scripts. While the attack complexity is low and no authentication is required, user interaction is needed for exploitation, potentially leading to information disclosure and limited integrity impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.