{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-04-25T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in contact/edit.php in the WP Ultimate Email Marketer plugin 1.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) listname or (2) contact parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-07-02T17:57:00.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://plugins.svn.wordpress.org/wp-ultimate-email-marketer/trunk/Readme.txt"}, {"tags": ["x_refsource_MISC"], "url": "http://codevigilant.com/disclosure/wp-plugin-wp-ultimate-email-marketer-a3-cross-site-scripting-xss"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-4600", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in contact/edit.php in the WP Ultimate Email Marketer plugin 1.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) listname or (2) contact parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://plugins.svn.wordpress.org/wp-ultimate-email-marketer/trunk/Readme.txt", "refsource": "MISC", "url": "http://plugins.svn.wordpress.org/wp-ultimate-email-marketer/trunk/Readme.txt"}, {"name": "http://codevigilant.com/disclosure/wp-plugin-wp-ultimate-email-marketer-a3-cross-site-scripting-xss", "refsource": "MISC", "url": "http://codevigilant.com/disclosure/wp-plugin-wp-ultimate-email-marketer-a3-cross-site-scripting-xss"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T11:20:27.023Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://plugins.svn.wordpress.org/wp-ultimate-email-marketer/trunk/Readme.txt"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://codevigilant.com/disclosure/wp-plugin-wp-ultimate-email-marketer-a3-cross-site-scripting-xss"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-4600", "datePublished": "2014-07-02T18:00:00.000Z", "dateReserved": "2014-06-23T00:00:00.000Z", "dateUpdated": "2024-08-06T11:20:27.023Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wp_ultimate_email_marketer_project:wp_ultimate_email_marketer:*:*:*:*:*:*:*:*", "matchCriteriaId": "046B58CB-2DBA-4DF9-A581-E8C3DC1FFE95", "versionEndIncluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*", "matchCriteriaId": "A77EB0E7-7FA7-4232-97DF-7C7587D163F1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in contact/edit.php in the WP Ultimate Email Marketer plugin 1.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) listname or (2) contact parameter."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de XSS en contact/edit.php en el plugin WP Ultimate Email Marketer 1.1.0 y anteriores para WordPress permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro (1) listname o (2) contact."}], "id": "CVE-2014-4600", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2014-07-02T18:55:11.003", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://codevigilant.com/disclosure/wp-plugin-wp-ultimate-email-marketer-a3-cross-site-scripting-xss"}, {"source": "cve@mitre.org", "url": "http://plugins.svn.wordpress.org/wp-ultimate-email-marketer/trunk/Readme.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://codevigilant.com/disclosure/wp-plugin-wp-ultimate-email-marketer-a3-cross-site-scripting-xss"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://plugins.svn.wordpress.org/wp-ultimate-email-marketer/trunk/Readme.txt"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}