CVE-2014-4527

Name of the Vulnerable Software and Affected Versions EnvialoSimple: Email Marketing and Newsletters plugin versions prior to 1.98

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the FormID or AdministratorID parameters in the paginas/vista-previa-form.php file.

Recommendations For EnvialoSimple: Email Marketing and Newsletters plugin versions prior to 1.98, update to version 1.98 or later to resolve the issue. As a temporary workaround, consider restricting access to the paginas/vista-previa-form.php file to minimize the risk of exploitation. Avoid using the FormID and AdministratorID parameters in the affected file until the issue is resolved.