Godaddy Email Marketing Sign Up Forms Vulnerabilities

The GoDaddy Email Marketing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_gem_form() function hooked via AJAX in versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve/...

CVSS:

4.3

Affected:

up to 1.4.3

Fix:

No patched version reported

Disclosed:

Nov 28, 2023

CVE-2023-49156 on NVD →

The GoDaddy Email Marketing plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions before 1.1.4. This is due to missing or incorrect nonce validation in the page_load function. This makes it possible for unauthenticated attackers to caused all the data associate with the plugin to be deleted via a...

CVSS:

8.8

Affected:

up to 1.1.4

Fixed in:

1.1.4

Disclosed:

Oct 27, 2016

CVE-2016-10903 on NVD →