CVE-2018-0602

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
icegram	Email Subscribers & Newsletters	prior to version 3.5.0

References

http://jvn.jp/en/jp/JVN16471686/index.htmlThird Party Advisory
https://wordpress.org/plugins/email-subscribers/#developersRelease Notes, Third Party Advisory
https://wpvulndb.com/vulnerabilities/9101
http://jvn.jp/en/jp/JVN16471686/index.htmlThird Party Advisory
https://wordpress.org/plugins/email-subscribers/#developersRelease Notes, Third Party Advisory
https://wpvulndb.com/vulnerabilities/9101

Timeline

Published: Jun 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-06036.1Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML v CVE-2018-06047.2Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors.CVE-2018-06056.1Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspec CVE-2018-06067.2SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via CVE-2018-06078.8SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to ex CVE-2018-06089.8Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via un CVE-2018-06097.8Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL i CVE-2018-06107.2Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbit CVE-2018-06117.4The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers CVE-2018-06126.1Cross-site scripting vulnerability in 5000 trillion yen converter v1.0.6 allows remote attackers to inject arbitrary web script or HTML via CVE-2018-06138.8NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earl CVE-2018-06146.1Cross-site scripting vulnerability in NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 an