What the vulnerability does
01Description
A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the function style_newsletter of the file lettreinfo.php. The manipulation of the argument email leads to cross site scripting. The attack may be launched remotely. The name of the patch is 3339b42316c5edf73e56eb209b6a3bb3e868d6ed. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230660.
Explanation of Vulnerability in Simple Terms
02Summary
The EELV Newsletter Plugin contains a stored cross-site scripting (XSS) vulnerability in version 2.x. An attacker with low-level access can inject malicious scripts that execute when other users view affected pages. The vulnerability requires user interaction to trigger and does not affect data confidentiality or availability.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view the plugin's content.
Potential impact on your site
04Site Impact
Users' browsers could execute attacker-controlled JavaScript, potentially stealing session tokens or performing actions on their behalf.
Conditions required to exploit
05Prerequisites
Attacker needs low-level user account access; victim must view a page containing the injected script.
Key dates
06Disclosure timeline
June 4, 2023
CVE published
August 6, 2024
Record updated
