Wp Ultimate Email Marketer Vulnerabilities

The WP Ultimate Email Marketer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'listname' & 'contact' parameters in versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scr...

CVSS:

6.1

Affected:

up to 1.1.0

Fix:

No patched version reported

Disclosed:

May 25, 2014

CVE-2014-4600 on NVD →

The WP Ultimate Email Marketer plugin 1.2.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaign.php, which allows remote attackers to modify list or campaign data.

CVSS:

9.8

Affected:

up to 1.2.0

Fix:

No patched version reported

Disclosed:

Sep 24, 2013

CVE-2013-3264 on NVD →

Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.2.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campaignname, (4) campaignformat, or (5) emai...

CVSS:

6.1

Affected:

up to 1.2.0

Fix:

No patched version reported

Disclosed:

Sep 24, 2013

CVE-2013-3263 on NVD →