Lucene search
WpvulndbWPVDB-ID:C6335DB8-3A51-4170-B052-2C68CC0AFF1BHistoryOct 26, 2023 - 12:00 a.m.
Newsletter & Bulk Email Sender <= 2.0.1 - Contributor+ Stored XSS
2023-10-2600:00:00
wpscan.com
2
newsletter
bulk email sender
validation
escape
parameters
contributor role
stored xss
security
Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
References
patchstack.com/database/vulnerability/newsletter-bulk-email/wordpress-newsletter-bulk-email-sender-plugin-2-0-1-cross-site-scripting-xss-vulnerability
www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/newsletter-bulk-email/newsletter-bulk-email-sender-201-authenticated-contributor-stored-cross-site-scripting
Related
cve
cve
CVE-2023-45829
2023-10-25 18:17:34
nvd
nvd
CVE-2023-45829
2023-10-25 18:17:34
cvelist
cvelist
prion
prion
Cross site scripting
2023-10-25 18:17:00
wordfence
wordfence
5.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
14.2%
Related for WPVDB-ID:C6335DB8-3A51-4170-B052-2C68CC0AFF1B