PT-2023-10015 · Unknown · Mail Subscribe List Plugin

Published 2023-05-02 · Updated 2024-05-17 · CVE-2013-10026

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mail Subscribe List Plugin versions up to 2.0.10

Description The issue affects some unknown processing of the file index.php. The manipulation of the argument sml name/sml email leads to cross site scripting. The attack may be initiated remotely.

Recommendations For Mail Subscribe List Plugin versions up to 2.0.10, upgrade to version 2.1 to address this issue. As a temporary workaround, consider restricting the use of the sml name and sml email arguments in the affected component until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-10026

Affected Products

Mail Subscribe List Plugin

References · 7

• https://github.com/wp-plugins/mail-subscribe-list/commit/484970ef8285cae51d2de3bd4e4684d33c956c28 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-10026 · Security Note
• https://t.me/cvenotify/49587 · Telegram Post
• https://vuldb.com/?ctiid.227765 · Note
• https://vuldb.com/?id.227765 · Note
• https://t.me/cibsecurity/63148 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-10026 · Note