CVE-2023-6527 Email Subscription Popup <= 1.2.18 - Reflected Cross-Site Scripting

What is CVE-2023-6527?

CVE-2023-6527 is a medium-severity cross-site scripting vulnerability in nik00726 Email Subscription Popup, published on 6 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all versions up to, and including, 1.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Weakness: CWE-79

Which versions are affected by CVE-2023-6527?

It affects 1 product.

Products include I13websolution Email Subscription Popup.

How do I fix CVE-2023-6527?

No fix has been published for CVE-2023-6527 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-6527 being exploited?

There is no known exploitation of CVE-2023-6527 in the wild and no public exploit code.

Other vulnerabilities in nik00726 Email Subscription Popup

• CVE-2024-27960 WordPress Email Subscription Popup plugin <= 1.2.20 - Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2023-30489 WordPress Email Subscription Popup Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS) High 7.1
• CVE-2024-11195 Cross-site scripting in Email Subscription Popup Medium 6.4
• CVE-2023-6555 Email Subscription Popup < 1.2.20 - Reflected XSS Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fv9g-wpxr-g2cq.