PT-2023-10257 · Atwellpub · Atwellpub Resend Welcome Email Plugin

Sdunham · Published 2023-02-12 · Updated 2024-05-17 · CVE-2015-10078

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions atwellpub Resend Welcome Email Plugin version 1.0.1

Description A problematic issue has been found in the atwellpub Resend Welcome Email Plugin, affecting the send welcome email url function of the file resend-welcome-email.php. This issue leads to cross-site scripting and can be initiated remotely.

Recommendations For atwellpub Resend Welcome Email Plugin version 1.0.1, upgrade to version 1.0.2 to address this issue. As a temporary workaround, consider disabling the send welcome email url function until the patch is applied. Restrict access to the affected file resend-welcome-email.php to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-10078

Affected Products

Atwellpub Resend Welcome Email Plugin

References · 6

• https://github.com/atwellpub/resend-welcome-email/pull/1 · Patch
• https://github.com/atwellpub/resend-welcome-email/commit/b14c1f66d307783f0ae74f88088a85999107695c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10078 · Security Note
• https://t.me/cibsecurity/57974 · Telegram Post
• https://vuldb.com/?ctiid.220637 · Note
• https://vuldb.com/?id.220637 · Note