CVE-2013-3263: XSS
First published: Tue Nov 05 2013(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campaignname, (4) campaignformat, or (5) emailtemplate parameter to campaign/campaigntwo.php; the (6) listid parameter to list/edit.php; the (7) campaignid or (8) siteurl parameter to campaign/editcampaign.php; the (9) campaignid parameter to campaign/selectlistb4send.php; the (10) campaignid, (11) campaignname, (12) campaignsubject, or (13) selectedcampaigns parameter to campaign/sendCampaign.php; or the (14) campaignid, (15) campaignname, (16) campaignformat, or (17) action parameter to campaign/updatecampaign.php.
Credit: PSIRT-CNA@flexerasoftware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Smackcoders Wp Ultimate Email Marketer Plugin | <=1.1.0 | |
| Smackcoders Wp Ultimate Email Marketer Plugin | =1.0.0 | |
| Smackcoders Wp Ultimate Email Marketer Plugin | =1.0.1 | |
| Smackcoders Wp Ultimate Email Marketer Plugin | =1.0.2 | |
| Smackcoders Wp Ultimate Email Marketer Plugin | =1.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2013-3263?
CVE-2013-3263 has a moderate severity rating due to its potential for cross-site scripting exploitation.
How do I fix CVE-2013-3263?
To mitigate CVE-2013-3263, update the WP Ultimate Email Marketer plugin to the latest version to patch the vulnerabilities.
Which versions of the WP Ultimate Email Marketer plugin are affected by CVE-2013-3263?
CVE-2013-3263 affects versions 1.1.0 and earlier of the WP Ultimate Email Marketer plugin.
What type of vulnerability is CVE-2013-3263?
CVE-2013-3263 is categorized as a cross-site scripting (XSS) vulnerability.
Can remote attackers exploit CVE-2013-3263?
Yes, remote attackers can exploit CVE-2013-3263 to inject arbitrary web scripts or HTML into the affected plugin.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/tags
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/smackcoders
- canonical/smackcoders wp ultimate email marketer plugin
- version/smackcoders wp ultimate email marketer plugin/1.1.0
- version/smackcoders wp ultimate email marketer plugin/1.0.0
- version/smackcoders wp ultimate email marketer plugin/1.0.1
- version/smackcoders wp ultimate email marketer plugin/1.0.2
- version/smackcoders wp ultimate email marketer plugin/1.0.3