CVE-2013-3263: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campaignname, (4) campaignformat, or (5) emailtemplate parameter to campaign/campaigntwo.php; the (6) listid parameter to list/edit.php; the (7) campaignid or (8) siteurl parameter to campaign/editcampaign.php; the (9) campaignid parameter to campaign/selectlistb4send.php; the (10) campaignid, (11) campaignname, (12) campaignsubject, or (13) selectedcampaigns parameter to campaign/sendCampaign.php; or the (14) campaignid, (15) campaignname, (16) campaignformat, or (17) action parameter to campaign/updatecampaign.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3263?
CVE-2013-3263 has a moderate severity rating due to its potential for cross-site scripting exploitation.
How do I fix CVE-2013-3263?
To mitigate CVE-2013-3263, update the WP Ultimate Email Marketer plugin to the latest version to patch the vulnerabilities.
Which versions of the WP Ultimate Email Marketer plugin are affected by CVE-2013-3263?
CVE-2013-3263 affects versions 1.1.0 and earlier of the WP Ultimate Email Marketer plugin.
What type of vulnerability is CVE-2013-3263?
CVE-2013-3263 is categorized as a cross-site scripting (XSS) vulnerability.
Can remote attackers exploit CVE-2013-3263?
Yes, remote attackers can exploit CVE-2013-3263 to inject arbitrary web scripts or HTML into the affected plugin.