CVE-2013-2640

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to "formData=save" requests, a different version than CVE-2013-0731.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/91274
http://plugins.trac.wordpress.org/changeset?new=682420Exploit, Patch
http://secunia.com/advisories/51917Vendor Advisory
http://wordpress.org/extend/plugins/wp-mailup/changelog/
http://osvdb.org/91274
http://plugins.trac.wordpress.org/changeset?new=682420Exploit, Patch
http://secunia.com/advisories/51917Vendor Advisory
http://wordpress.org/extend/plugins/wp-mailup/changelog/

Timeline

Published: Mar 22, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-26415.0Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via CVE-2013-26429.3Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip para CVE-2013-26434.3Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web sc CVE-2013-26459.3Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_120405 allow remote at CVE-2013-26467.5TP-LINK TL-WR1043ND V1_120405 devices contain an unspecified denial of service vulnerability.CVE-2013-26514.3Multiple cross-site scripting (XSS) vulnerabilities in BoltWire 3.5 and earlier allow remote attackers to inject arbitrary web script or HTM CVE-2013-26524.3CRLF injection vulnerability in help/help_language.php in WebCollab 3.30 and earlier allows remote attackers to inject arbitrary HTTP header CVE-2013-26535.8security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct CVE-2013-26704.3Cross-site scripting (XSS) vulnerability in the Brother MFC-9970CDW printer with firmware G (1.03) and L (1.10) allows remote attackers to i CVE-2013-26714.3Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware L (1.10) allow remote attackers to inje CVE-2013-26727.5Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords.CVE-2013-26736.8Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unau