Smackcoders Inc. wp ultimate email marketer plugin vulnerabilities

Latest Smackcoders Inc. wp ultimate email marketer plugin CVEs

Newest publication first

1. CVE-2013-3264 WP Ultimate Email Marketer <= 1.2.0 - Authentication Bypass

   Published 2013-11-05

   Medium·CVSS 6.4 EPSS 2.1%

   The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaign.php, which allows remote attackers to modify list or campaign data.

2. CVE-2013-3263 WP Ultimate Email Marketer <= 1.2.0 - Cross-Site Scripting

   Published 2013-11-05

   Medium·CVSS 4.3 EPSS 1.6%

   Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campa...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.