Reflected Cross-site Scripting Vulnerability in Tribulant Newsletters

CVE-2024-47346

Summary

A reflective cross-site scripting (XSS) vulnerability has been identified in the Tribulant Newsletters plugin, which permits attackers to inject malicious scripts into web pages viewed by users. This vulnerability affects all versions of the Newsletters plugin up to and including 4.9.9.1, allowing attackers to exploit improper sanitization of user input during web page generation. When exploited, this issue can lead to the execution of arbitrary scripts in the context of the user's browser, potentially compromising user data, session tokens, and other sensitive information. It is crucial for users of the affected versions to apply necessary patches to mitigate the risks associated with this vulnerability.

References