Mailster
Monthly
Arbitrary file upload in the Mailster WordPress email newsletter plugin (versions 4.1.17 and earlier) lets a user with Editor-level privileges upload files of dangerous types, enabling web shell placement and remote code execution on the host. Rated CVSS 9.1 and reported by Patchstack, the flaw abuses insufficient validation in an editor-accessible upload feature; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.0.9. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.0.6. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arbitrary file upload in the Mailster WordPress email newsletter plugin (versions 4.1.17 and earlier) lets a user with Editor-level privileges upload files of dangerous types, enabling web shell placement and remote code execution on the host. Rated CVSS 9.1 and reported by Patchstack, the flaw abuses insufficient validation in an editor-accessible upload feature; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.0.9. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.0.6. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.