Unrated severityNVD Advisory· Published Jan 16, 2014· Updated Apr 29, 2026
CVE-2012-6628
CVE-2012-6628
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_campaign.php, (3) xyz_em_email parameter to admin/edit_email.php, (4) xyz_em_exportbatchSize parameter to import_export.php, or (5) pagination limit in the Newsletter Manager options.
Affected products
3cpe:2.3:a:xyzscripts:newsletter_manager:*:-:-:*:-:wordpress:*:*+ 2 more
- cpe:2.3:a:xyzscripts:newsletter_manager:*:-:-:*:-:wordpress:*:*range: <=1.0.2
- cpe:2.3:a:xyzscripts:newsletter_manager:1.0:-:-:*:-:wordpress:*:*
- cpe:2.3:a:xyzscripts:newsletter_manager:1.0.1:-:-:*:-:wordpress:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- packetstormsecurity.org/files/112694/WordPress-Newsletter-Manager-1.0-Cross-Site-Scripting.htmlnvdExploit
- plugins.trac.wordpress.org/changeset/533904nvdExploitPatch
- secunia.com/advisories/49183nvdVendor Advisory
News mentions
0No linked articles in our index yet.