{"id":"GHSA-vwfx-hh3w-fj99","aliases":["CVE-2021-21418"],"title":"Potential XSS injection in the newsletter conditions field","description":"### Impact\nAn employee can inject javascript in the newsletter condition field that will then be executed on the front office\n\n### Patches\nThe issue has been fixed in 2.6.1","severity":"medium","score":4.6,"published":"2021-04-06T17:24:14.000Z","modified":"2026-07-08T06:27:33.161Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"prestashop/ps_emailsubscription","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.6.1"}],"type":"ECOSYSTEM"}],"versions":["v1.0.1","v1.1.0","v1.1.1","v1.1.2","v1.1.6","v2.1.0","v2.2.0","v2.3.0","v2.5.0","v2.6.0"],"fixed":["2.6.1"]}],"references":["https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99","https://nvd.nist.gov/vuln/detail/CVE-2021-21418","https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70","https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1","https://packagist.org/packages/prestashop/ps_emailsubscription"],"sources":[{"name":"OSV","id":"GHSA-vwfx-hh3w-fj99","modified":"2026-07-08T06:27:33.161549592Z","url":"https://osv.dev/vulnerability/GHSA-vwfx-hh3w-fj99"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","score":4.6}]}