PT-2023-10015 · Unknown · Mail Subscribe List Plugin

CVE-2013-10026 · Publicado 2023-05-02 · Atualizado 2024-05-17

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mail Subscribe List Plugin versions up to 2.0.10

Description The issue affects some unknown processing of the file index.php. The manipulation of the argument sml name/sml email leads to cross site scripting. The attack may be initiated remotely.

Recommendations For Mail Subscribe List Plugin versions up to 2.0.10, upgrade to version 2.1 to address this issue. As a temporary workaround, consider restricting the use of the sml name and sml email arguments in the affected component until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-10026

Produtos afetados

Mail Subscribe List Plugin

Referências · 7

• https://github.com/wp-plugins/mail-subscribe-list/commit/484970ef8285cae51d2de3bd4e4684d33c956c28 · Correção
• https://t.me/cvenotify/49587 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2013-10026 · Nota de Segurança
• https://vuldb.com/?ctiid.227765 · Nota
• https://vuldb.com/?id.227765 · Nota
• https://t.me/cibsecurity/63148 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-10026 · Nota