Description
A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/add_field_to_form.php. The manipulation of the argument field_name/merge_tag/field_type/list_id leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 6.8.6 is able to address this issue. The name of the patch is 3662c6593aa1bb4286781214891d26de2e947695. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215307.
References (4)
Core 4
Core References
Patch, Third Party Advisory
https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/commit/3662c6593aa1bb4286781214891d26de2e947695
Patch, Third Party Advisory
https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/pull/889
Release Notes, Third Party Advisory
https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/releases/tag/6.8.6
Third Party Advisory
https://vuldb.com/?id.215307
Scores
CVSS v3
2.6
EPSS
0.0054
EPSS Percentile
41.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
CWE-707
Status
published
Products (2)
yikesinc/yikes-inc-easy-mailchimp-extender
0 - 6.8.6Packagist
yikesplugins/easy_forms_for_mailchimp
< 6.8.6
Published
Dec 12, 2022
Tracked Since
Feb 18, 2026