CVE-2020-35933

A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a…

Medium · published January 1, 2021

CVSS v3.1
6.5
EPSS
1%
Percentile
58.2
In the wild
Unconfirmed
What it is

A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:L/C:L/I:L/PR:L/S:C/UI:R
CVSS v4.0
Not supplied
EPSS
0.00865 · 58.2th percentile
Published
2021-01-01T01:24Z
EPSS history
Timeline
  • 01 JAN 01:24Z
    A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a…
    cvelistv5