CVE-2012-6628: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyzemcampName to admin/createcampaign.php or (2) admin/editcampaign.php, (3) xyzememail parameter to admin/editemail.php, (4) xyzemexportbatchSize parameter to importexport.php, or (5) pagination limit in the Newsletter Manager options.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6628?
CVE-2012-6628 is considered a moderate severity vulnerability due to its potential exploitation via cross-site scripting.
How do I fix CVE-2012-6628?
To fix CVE-2012-6628, update the Newsletter Manager plugin to version 1.0.2 or later.
What kind of attacks can CVE-2012-6628 facilitate?
CVE-2012-6628 can facilitate remote attackers to inject arbitrary web scripts or HTML, leading to potential malicious content execution.
Which versions of the Newsletter Manager are affected by CVE-2012-6628?
CVE-2012-6628 affects Newsletter Manager versions prior to 1.0.2.
What components of the Newsletter Manager are vulnerable in CVE-2012-6628?
The vulnerable components include the admin/create_campaign.php and admin/edit_campaign.php scripts.