Lucene search
WpvulndbWPVDB-ID:C6335DB8-3A51-4170-B052-2C68CC0AFF1BHistoryOct 26, 2023 - 12:00 a.m.
Newsletter & Bulk Email Sender <= 2.0.1 - Contributor+ Stored XSS
2023-10-2600:00:00
wpscan.com
4
newsletter
bulk email sender
validation
escape
parameters
contributor role
stored xss
security
Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
References
patchstack.com/database/vulnerability/newsletter-bulk-email/wordpress-newsletter-bulk-email-sender-plugin-2-0-1-cross-site-scripting-xss-vulnerability
www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/newsletter-bulk-email/newsletter-bulk-email-sender-201-authenticated-contributor-stored-cross-site-scripting
Related
cve
cve
CVE-2023-45829
2023-10-25 18:17:34
prion
prion
Cross site scripting
2023-10-25 18:17:00
cvelist
cvelist
nvd
nvd
CVE-2023-45829
2023-10-25 18:17:34
wordfence
wordfence
AI Score
5.7
Confidence
High
EPSS
0.001
Percentile
18.6%
Related for WPVDB-ID:C6335DB8-3A51-4170-B052-2C68CC0AFF1B