Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for wp-mailup by mailup

    CVE-2013-2640 (GCVE-0-2013-2640)

    Vulnerability from nvd – Published: 2013-03-22 17:00 – Updated: 2024-09-16 22:34
    VLAI
    Summary
    ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to "formData=save" requests, a different version than CVE-2013-0731.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://plugins.trac.wordpress.org/changeset?new=682420 x_refsource_MISC
    http://secunia.com/advisories/51917 third-party-advisoryx_refsource_SECUNIA
    http://wordpress.org/extend/plugins/wp-mailup/cha… x_refsource_CONFIRM
    http://osvdb.org/91274 vdb-entryx_refsource_OSVDB
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-06T15:44:32.587Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
              },
              {
                "name": "51917",
                "tags": [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
                  "x_transferred"
                ],
                "url": "http://secunia.com/advisories/51917"
              },
              {
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
              },
              {
                "name": "91274",
                "tags": [
                  "vdb-entry",
                  "x_refsource_OSVDB",
                  "x_transferred"
                ],
                "url": "http://osvdb.org/91274"
              }
            ],
            "title": "CVE Program Container"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n/a",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to \"formData=save\" requests, a different version than CVE-2013-0731."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "n/a",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2013-03-22T17:00:00.000Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
            },
            {
              "name": "51917",
              "tags": [
                "third-party-advisory",
                "x_refsource_SECUNIA"
              ],
              "url": "http://secunia.com/advisories/51917"
            },
            {
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
            },
            {
              "name": "91274",
              "tags": [
                "vdb-entry",
                "x_refsource_OSVDB"
              ],
              "url": "http://osvdb.org/91274"
            }
          ],
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "cve@mitre.org",
              "ID": "CVE-2013-2640",
              "STATE": "PUBLIC"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "n/a",
                          "version": {
                            "version_data": [
                              {
                                "version_value": "n/a"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "n/a"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to \"formData=save\" requests, a different version than CVE-2013-0731."
                }
              ]
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "n/a"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "http://plugins.trac.wordpress.org/changeset?new=682420",
                  "refsource": "MISC",
                  "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
                },
                {
                  "name": "51917",
                  "refsource": "SECUNIA",
                  "url": "http://secunia.com/advisories/51917"
                },
                {
                  "name": "http://wordpress.org/extend/plugins/wp-mailup/changelog/",
                  "refsource": "CONFIRM",
                  "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
                },
                {
                  "name": "91274",
                  "refsource": "OSVDB",
                  "url": "http://osvdb.org/91274"
                }
              ]
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2013-2640",
        "datePublished": "2013-03-22T17:00:00.000Z",
        "dateReserved": "2013-03-22T00:00:00.000Z",
        "dateUpdated": "2024-09-16T22:34:59.491Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2013-0731 (GCVE-0-2013-0731)

    Vulnerability from nvd – Published: 2013-03-22 15:00 – Updated: 2024-08-06 14:33
    VLAI
    Summary
    ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie. NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://plugins.trac.wordpress.org/changeset?new=682420 x_refsource_MISC
    http://www.securityfocus.com/bid/58467 vdb-entryx_refsource_BID
    http://secunia.com/advisories/51917 third-party-advisoryx_refsource_SECUNIA
    http://wordpress.org/extend/plugins/wp-mailup/cha… x_refsource_CONFIRM
    http://osvdb.org/91274 vdb-entryx_refsource_OSVDB
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    Date Public
    2013-03-12 00:00
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-06T14:33:05.601Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
              },
              {
                "name": "58467",
                "tags": [
                  "vdb-entry",
                  "x_refsource_BID",
                  "x_transferred"
                ],
                "url": "http://www.securityfocus.com/bid/58467"
              },
              {
                "name": "51917",
                "tags": [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
                  "x_transferred"
                ],
                "url": "http://secunia.com/advisories/51917"
              },
              {
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
              },
              {
                "name": "91274",
                "tags": [
                  "vdb-entry",
                  "x_refsource_OSVDB",
                  "x_transferred"
                ],
                "url": "http://osvdb.org/91274"
              },
              {
                "name": "mailup-ajaxfunctions-security-bypass(82847)",
                "tags": [
                  "vdb-entry",
                  "x_refsource_XF",
                  "x_transferred"
                ],
                "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82847"
              }
            ],
            "title": "CVE Program Container"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n/a",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "datePublic": "2013-03-12T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie.  NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "n/a",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2017-08-28T12:57:01.000Z",
            "orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
            "shortName": "flexera"
          },
          "references": [
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
            },
            {
              "name": "58467",
              "tags": [
                "vdb-entry",
                "x_refsource_BID"
              ],
              "url": "http://www.securityfocus.com/bid/58467"
            },
            {
              "name": "51917",
              "tags": [
                "third-party-advisory",
                "x_refsource_SECUNIA"
              ],
              "url": "http://secunia.com/advisories/51917"
            },
            {
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
            },
            {
              "name": "91274",
              "tags": [
                "vdb-entry",
                "x_refsource_OSVDB"
              ],
              "url": "http://osvdb.org/91274"
            },
            {
              "name": "mailup-ajaxfunctions-security-bypass(82847)",
              "tags": [
                "vdb-entry",
                "x_refsource_XF"
              ],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82847"
            }
          ],
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
              "ID": "CVE-2013-0731",
              "STATE": "PUBLIC"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "n/a",
                          "version": {
                            "version_data": [
                              {
                                "version_value": "n/a"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "n/a"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie.  NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2."
                }
              ]
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "n/a"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "http://plugins.trac.wordpress.org/changeset?new=682420",
                  "refsource": "MISC",
                  "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
                },
                {
                  "name": "58467",
                  "refsource": "BID",
                  "url": "http://www.securityfocus.com/bid/58467"
                },
                {
                  "name": "51917",
                  "refsource": "SECUNIA",
                  "url": "http://secunia.com/advisories/51917"
                },
                {
                  "name": "http://wordpress.org/extend/plugins/wp-mailup/changelog/",
                  "refsource": "CONFIRM",
                  "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
                },
                {
                  "name": "91274",
                  "refsource": "OSVDB",
                  "url": "http://osvdb.org/91274"
                },
                {
                  "name": "mailup-ajaxfunctions-security-bypass(82847)",
                  "refsource": "XF",
                  "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82847"
                }
              ]
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
        "assignerShortName": "flexera",
        "cveId": "CVE-2013-0731",
        "datePublished": "2013-03-22T15:00:00.000Z",
        "dateReserved": "2013-01-02T00:00:00.000Z",
        "dateUpdated": "2024-08-06T14:33:05.601Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2013-2640 (GCVE-0-2013-2640)

    Vulnerability from cvelistv5 – Published: 2013-03-22 17:00 – Updated: 2024-09-16 22:34
    VLAI
    Summary
    ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to "formData=save" requests, a different version than CVE-2013-0731.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://plugins.trac.wordpress.org/changeset?new=682420 x_refsource_MISC
    http://secunia.com/advisories/51917 third-party-advisoryx_refsource_SECUNIA
    http://wordpress.org/extend/plugins/wp-mailup/cha… x_refsource_CONFIRM
    http://osvdb.org/91274 vdb-entryx_refsource_OSVDB
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-06T15:44:32.587Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
              },
              {
                "name": "51917",
                "tags": [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
                  "x_transferred"
                ],
                "url": "http://secunia.com/advisories/51917"
              },
              {
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
              },
              {
                "name": "91274",
                "tags": [
                  "vdb-entry",
                  "x_refsource_OSVDB",
                  "x_transferred"
                ],
                "url": "http://osvdb.org/91274"
              }
            ],
            "title": "CVE Program Container"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n/a",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to \"formData=save\" requests, a different version than CVE-2013-0731."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "n/a",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2013-03-22T17:00:00.000Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
            },
            {
              "name": "51917",
              "tags": [
                "third-party-advisory",
                "x_refsource_SECUNIA"
              ],
              "url": "http://secunia.com/advisories/51917"
            },
            {
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
            },
            {
              "name": "91274",
              "tags": [
                "vdb-entry",
                "x_refsource_OSVDB"
              ],
              "url": "http://osvdb.org/91274"
            }
          ],
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "cve@mitre.org",
              "ID": "CVE-2013-2640",
              "STATE": "PUBLIC"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "n/a",
                          "version": {
                            "version_data": [
                              {
                                "version_value": "n/a"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "n/a"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to \"formData=save\" requests, a different version than CVE-2013-0731."
                }
              ]
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "n/a"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "http://plugins.trac.wordpress.org/changeset?new=682420",
                  "refsource": "MISC",
                  "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
                },
                {
                  "name": "51917",
                  "refsource": "SECUNIA",
                  "url": "http://secunia.com/advisories/51917"
                },
                {
                  "name": "http://wordpress.org/extend/plugins/wp-mailup/changelog/",
                  "refsource": "CONFIRM",
                  "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
                },
                {
                  "name": "91274",
                  "refsource": "OSVDB",
                  "url": "http://osvdb.org/91274"
                }
              ]
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2013-2640",
        "datePublished": "2013-03-22T17:00:00.000Z",
        "dateReserved": "2013-03-22T00:00:00.000Z",
        "dateUpdated": "2024-09-16T22:34:59.491Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2013-0731 (GCVE-0-2013-0731)

    Vulnerability from cvelistv5 – Published: 2013-03-22 15:00 – Updated: 2024-08-06 14:33
    VLAI
    Summary
    ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie. NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://plugins.trac.wordpress.org/changeset?new=682420 x_refsource_MISC
    http://www.securityfocus.com/bid/58467 vdb-entryx_refsource_BID
    http://secunia.com/advisories/51917 third-party-advisoryx_refsource_SECUNIA
    http://wordpress.org/extend/plugins/wp-mailup/cha… x_refsource_CONFIRM
    http://osvdb.org/91274 vdb-entryx_refsource_OSVDB
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    Date Public
    2013-03-12 00:00
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-06T14:33:05.601Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
              },
              {
                "name": "58467",
                "tags": [
                  "vdb-entry",
                  "x_refsource_BID",
                  "x_transferred"
                ],
                "url": "http://www.securityfocus.com/bid/58467"
              },
              {
                "name": "51917",
                "tags": [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
                  "x_transferred"
                ],
                "url": "http://secunia.com/advisories/51917"
              },
              {
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
              },
              {
                "name": "91274",
                "tags": [
                  "vdb-entry",
                  "x_refsource_OSVDB",
                  "x_transferred"
                ],
                "url": "http://osvdb.org/91274"
              },
              {
                "name": "mailup-ajaxfunctions-security-bypass(82847)",
                "tags": [
                  "vdb-entry",
                  "x_refsource_XF",
                  "x_transferred"
                ],
                "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82847"
              }
            ],
            "title": "CVE Program Container"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n/a",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "datePublic": "2013-03-12T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie.  NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "n/a",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2017-08-28T12:57:01.000Z",
            "orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
            "shortName": "flexera"
          },
          "references": [
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
            },
            {
              "name": "58467",
              "tags": [
                "vdb-entry",
                "x_refsource_BID"
              ],
              "url": "http://www.securityfocus.com/bid/58467"
            },
            {
              "name": "51917",
              "tags": [
                "third-party-advisory",
                "x_refsource_SECUNIA"
              ],
              "url": "http://secunia.com/advisories/51917"
            },
            {
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
            },
            {
              "name": "91274",
              "tags": [
                "vdb-entry",
                "x_refsource_OSVDB"
              ],
              "url": "http://osvdb.org/91274"
            },
            {
              "name": "mailup-ajaxfunctions-security-bypass(82847)",
              "tags": [
                "vdb-entry",
                "x_refsource_XF"
              ],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82847"
            }
          ],
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
              "ID": "CVE-2013-0731",
              "STATE": "PUBLIC"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "n/a",
                          "version": {
                            "version_data": [
                              {
                                "version_value": "n/a"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "n/a"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie.  NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2."
                }
              ]
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "n/a"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "http://plugins.trac.wordpress.org/changeset?new=682420",
                  "refsource": "MISC",
                  "url": "http://plugins.trac.wordpress.org/changeset?new=682420"
                },
                {
                  "name": "58467",
                  "refsource": "BID",
                  "url": "http://www.securityfocus.com/bid/58467"
                },
                {
                  "name": "51917",
                  "refsource": "SECUNIA",
                  "url": "http://secunia.com/advisories/51917"
                },
                {
                  "name": "http://wordpress.org/extend/plugins/wp-mailup/changelog/",
                  "refsource": "CONFIRM",
                  "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/"
                },
                {
                  "name": "91274",
                  "refsource": "OSVDB",
                  "url": "http://osvdb.org/91274"
                },
                {
                  "name": "mailup-ajaxfunctions-security-bypass(82847)",
                  "refsource": "XF",
                  "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82847"
                }
              ]
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
        "assignerShortName": "flexera",
        "cveId": "CVE-2013-0731",
        "datePublished": "2013-03-22T15:00:00.000Z",
        "dateReserved": "2013-01-02T00:00:00.000Z",
        "dateUpdated": "2024-08-06T14:33:05.601Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }