Email Subscribers & Newsletters < 2.9.1 - Cross-Site Scripting
Strategic Overview
< 2.9.1N/AVulnerability Overview
The Email Subscribers & Newsletters plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 2.9.1 via the following parameters: 1) 'search' and 'es_mail_group' parameters in sendmail.php 2) 'search', 'sts', and 'cnt' parameters in view-subscriber-show.php 3) 'pagemail' parameter in sentmail-preview.php. This is due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Technical Analysis
REMEDIATION: Update to version 2.9.1, or a newer patched version --- IDENTIFIER: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C