PT-2018-9617

CVE-2018-1002009

Published

2018-12-03

Updated

2018-12-27

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WordPress Arigato Autoresponder and News letter version 2.5.1.8

Description: The issue is related to a reflected XSS vulnerability that requires administrative privileges to exploit. It is located in the unsubscribe.html.php file and can be triggered via a GET request to the email variable.

Recommendations: For WordPress Arigato Autoresponder and News letter version 2.5.1.8, consider restricting access to the unsubscribe.html.php file until a patch is available. As a temporary workaround, avoid using the email variable in the affected GET request to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Larry W. Cashdollar

Larry0

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers