CVE-2021-21418mediumCWE-79

CVE-2021-21418: medium-severity vulnerability in PrestaShop ps_emailsubscription

Potential XSS injection in the newsletter conditions field

Published 31 Mar 2021 · Updated 03 Aug 2024

Follow this CVE + Monitor ps emailsubscription + Monitor prestashop/ps_emailsubscription

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.6epss 0.8%

ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Affected products

PrestaShop · ps_emailsubscription

References

https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70 https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1 https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99 https://packagist.org/packages/prestashop/ps_emailsubscription