PT-2022-11596 · WordPress · Yikes-Inc-Easy-Mailchimp-Extender

Jpowersdev · Published 2022-12-12 · Updated 2022-12-15 · CVE-2021-4244

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions yikes-inc-easy-mailchimp-extender Plugin versions up to 6.8.5

Description A vulnerability has been found in the yikes-inc-easy-mailchimp-extender Plugin, affecting an unknown part of the file admin/partials/ajax/add field to form.php. The manipulation of the field name, merge tag, field type, and list id arguments leads to cross-site scripting. It is possible to initiate the attack remotely.

Recommendations For yikes-inc-easy-mailchimp-extender Plugin versions up to 6.8.5, upgrade to version 6.8.6 to address this issue. As a temporary workaround, consider restricting access to the admin/partials/ajax/add field to form.php file until the upgrade is applied. Avoid using the field name, merge tag, field type, and list id arguments in the affected API endpoint until the issue is resolved.

Fix

XSS

Improper Neutralization

Weakness Enumeration

CWE-79

CWE-707

Related Identifiers

CVE-2021-4244

GHSA-837V-6VGX-JQCC

Affected Products

Yikes-Inc-Easy-Mailchimp-Extender

References · 9

• https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/commit/3662c6593aa1bb4286781214891d26de2e947695 · Patch
• https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/pull/889 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-4244 · Security Note
• https://osv.dev/vulnerability/GHSA-837v-6vgx-jqcc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4244 · Vendor Advisory
• https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/releases/tag/6.8.6 · Note
• https://github.com/yikesinc/yikes-inc-easy-mailchimp-extender · Note
• https://t.me/cibsecurity/54287 · Telegram Post
• https://vuldb.com/?id.215307 · Note