Brevo

9 CVEs across 4 Brevo products. Browse Brevo vulnerabilities, severities, and proof-of-concept exploits.

Brevo products with known CVEs

ProductCVEs
Newsletter\, Smtp\, Email Marketing And Subscribe5
Newsletter, Smtp, Email Marketing And Subscribe Forms By Sendinblue2
Sendinblue For Woocommerce2
Brevo1
Brevo CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-66128Medium5.32025-12-16Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured…
CVE-2024-8477Medium4.32024-10-10The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all…
CVE-2024-43287Medium4.32024-08-26Cross-Site Request Forgery (CSRF) vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMT…
CVE-2024-35668High7.12024-06-04Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscr…
CVE-2024-32807High8.52024-05-06Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brevo Sendinblue for WooCommerce allows Relative Path Traversal…
CVE-2023-26859Critical9.82023-07-26SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderTracking.php compone…
CVE-2023-2472Medium6.12023-06-05The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputti…
CVE-2021-24874Medium6.12022-02-14The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before output…
CVE-2021-24923Medium6.12022-01-24The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before…