Convertkit
Monthly
The ConvertKit - Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ConvertKit's WordPress email marketing plugin (versions through 2.4.5) writes subscriber email addresses into plugin log files that may be directly accessible over HTTP, exposing personally identifiable information to unauthenticated remote attackers. The NVD-assigned CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N) reflects scenarios where the plugin stores logs within the web-accessible wp-content directory without access controls. No public exploit exists and no KEV listing is present; EPSS at 0.99% (77th percentile) signals a below-average but non-negligible exploitation probability relative to all CVEs.
The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The ConvertKit - Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ConvertKit's WordPress email marketing plugin (versions through 2.4.5) writes subscriber email addresses into plugin log files that may be directly accessible over HTTP, exposing personally identifiable information to unauthenticated remote attackers. The NVD-assigned CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N) reflects scenarios where the plugin stores logs within the web-accessible wp-content directory without access controls. No public exploit exists and no KEV listing is present; EPSS at 0.99% (77th percentile) signals a below-average but non-negligible exploitation probability relative to all CVEs.
The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.