blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2013-3263

MEDIUM 4.3 CVSS 2.0
Published
November 5, 2013
Last modified
June 16, 2026
NVD status
Modified
Reported by
PSIRT-CNA@flexerasoftware.com
Weakness
CWE-79
CVSS vector
AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campaignname, (4) campaignformat, or (5) emailtemplate parameter to campaign/campaigntwo.php; the (6) listid parameter to list/edit.php; the (7) campaignid or (8) siteurl parameter to campaign/editcampaign.php; the (9) campaignid parameter to campaign/selectlistb4send.php; the (10) campaignid, (11) campaignname, (12) campaignsubject, or (13) selectedcampaigns parameter to campaign/sendCampaign.php; or the (14) campaignid, (15) campaignname, (16) campaignformat, or (17) action parameter to campaign/updatecampaign.php.

Affected products and versions

  • n/a n/a — Versions not specified
  • smackcoders wp_ultimate_email_marketer_plugin — Up to and including 1.1.0
  • smackcoders wp_ultimate_email_marketer_plugin — Version 1.0.0
  • smackcoders wp_ultimate_email_marketer_plugin — Version 1.0.1
  • smackcoders wp_ultimate_email_marketer_plugin — Version 1.0.2
  • smackcoders wp_ultimate_email_marketer_plugin — Version 1.0.3

References