CVE-2021-21418
Potential XSS injection in the newsletter conditions field
- State
- Published
- Severity
- 4.6 Medium
- Published
- Mar 31, 2021
- Updated
- Aug 3, 2024
- Reserved
- Dec 22, 2020
Description
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.6 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | GitHub_M |
Weaknesses
- CWE-79 {"CWE-79":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}
Affected Products
| Product | Versions |
|---|---|
ps_emailsubscriptionPrestaShop |
|
References
- https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99
- https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70
- https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1
- https://packagist.org/packages/prestashop/ps_emailsubscription
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.