PT-2019-13643 · WordPress · Email Subscribers & Newsletters

Published 2019-07-28 · Updated 2023-03-03 · CVE-2019-14364

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters plugin version 4.1.6

Description The issue allows an attacker to inject malicious JavaScript code through a publicly available subscription form. This is achieved by exploiting the esfpx name parameter in the "wp-admin/admin-ajax.php" API endpoint.

Recommendations For Email Subscribers & Newsletters plugin version 4.1.6, consider disabling the subscription form until a patch is available to prevent exploitation. Restrict access to the "wp-admin/admin-ajax.php" API endpoint to minimize the risk of malicious code injection. Avoid using the esfpx name parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-14364

Affected Products

Email Subscribers & Newsletters

References · 6

• 🔥 https://github.com/ivoschyk-cs/CVE-s/blob/master/Email%20Subscribers%20%26%20Newsletters%20Wordpress%20Plugin%20%28XSS%29 · Exploit
• 🔥 https://github.com/ivoschyk-cs/CVE-s/blob/master/Email%20Subscribers%20%26%20Newsletters%20Wordpress%20Plugin%20(XSS) · Exploit
• https://osv.dev/vulnerability/CVE-2019-14364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14364 · Security Note
• https://wordpress.org/plugins/email-subscribers/#developers · Note
• https://wpvulndb.com/vulnerabilities/9508 · Note