Getresponse Integration Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GetResponse GetResponse for WordPress allows Stored XSS.This issue affects GetResponse for WordPress: from n/a through 5.5.33.

Affected:

up to 5.5.33

Fix:

No patched version reported

Disclosed:

Mar 31, 2024

CVE-2024-31104 on NVD →

The GetResponse for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script...

CVSS:

6.4

Affected:

up to 5.5.35

Fix:

No patched version reported

Disclosed:

Mar 29, 2024

CVE-2024-31104 on NVD →

[en] The GetResponse for WordPress plugin through 5.5.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected:

up to 5.5.32

Fixed in:

5.5.32

Disclosed:

Mar 20, 2023

CVE-2023-0167 on NVD →

Update the WordPress GetResponse for WordPress plugin to the latest available version (at least 5.5.32). Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress GetResponse for WordPress Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, adverti...

Affected:

up to 5.5.32

Fixed in:

5.5.32

Disclosed:

Jan 26, 2023

The GetResponse for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 5.5.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribut...

CVSS:

6.4

Affected:

up to 5.5.31

Fixed in:

5.5.32

Disclosed:

Jan 25, 2023

CVE-2023-0167 on NVD →

The GetResponse for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 5.5.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribut...

Affected:

up to 5.5.32

Fixed in:

5.5.32

Disclosed:

Jan 25, 2023

[en] Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress.

Affected:

up to 5.5.21

Fixed in:

5.5.21

Disclosed:

Sep 9, 2022

CVE-2022-35277 on NVD →

The GetResponse plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.5.19. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to trigger API Key updates via forged request granted they can tri...

CVSS:

8.8

Affected:

up to 5.5.19

Fixed in:

5.5.21

Disclosed:

Sep 1, 2022

CVE-2022-35277 on NVD →