CVE-2021-21418

🗓️ 31 Mar 2021 17:35:15Reported by GitHub_MType

ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office

Reporter	Title	Published	Views	Family All 10
CNNVD	Progi1984 ps_emailsubscription 跨站脚本漏洞	31 Mar 202100:00	–	cnnvd
Cvelist	CVE-2021-21418 Potential XSS injection in the newsletter conditions field	31 Mar 202117:35	–	cvelist
EUVD	EUVD-2021-0883	7 Oct 202500:30	–	euvd
Github Security Blog	Potential XSS injection in the newsletter conditions field	6 Apr 202117:24	–	github
NVD	CVE-2021-21418	31 Mar 202118:15	–	nvd
OSV	CVE-2021-21418	31 Mar 202118:15	–	osv
OSV	GHSA-VWFX-HH3W-FJ99 Potential XSS injection in the newsletter conditions field	6 Apr 202117:24	–	osv
Prion	Race condition	31 Mar 202118:15	–	prion
RedhatCVE	CVE-2021-21418	22 May 202518:19	–	redhatcve
Veracode	Cross-site Scripting (XSS)	1 Apr 202103:43	–	veracode

NVD

Vulners

Node

prestashop ps_emailsubscriptionRange2.6.0–2.6.1prestashop

[
  {
    "product": "ps_emailsubscription",
    "vendor": "PrestaShop",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.6.1"
      }
    ]
  }
]

Source	Link
github	www.github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99
github	www.github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1
packagist	www.packagist.org/packages/prestashop/ps_emailsubscription
github	www.github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70

17 Jun 2026 03:35Current

4.9Medium risk

Vulners AI Score4.9

CVSS 23.5

CVSS 3.14.6 - 5.4

EPSS0.00786

CWE-79