yikes-inc-easy-mailchimp-extender Cross-site Scripting vulnerability
Impact
A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/add_field_to_form.php. The manipulation of the argument field_name/merge_tag/field_type/list_id leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 6.8.6 can address this issue. The name of the patch is 3662c6593aa1bb4286781214891d26de2e947695. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215307.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 6.8.6Ecosystem versions | 6.8.6 |
Version evidence: OSV · GHSA-837v-6vgx-jqcc
View original version evidence (37 explicit versions)
Original source description
A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/add_field_to_form.php. The manipulation of the argument field_name/merge_tag/field_type/list_id leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 6.8.6 can address this issue. The name of the patch is 3662c6593aa1bb4286781214891d26de2e947695. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215307.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2021-4244
- Patch github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/pull/889
- Patch github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/commit/3662c6593aa1bb4286781214891d26de2e947695
- Release notes github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/releases/tag/6.8.6
- Source reference github.com/yikesinc/yikes-inc-easy-mailchimp-extender
- Source reference vuldb.com/