CVE-2013-10026: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress. This issue affects some unknown processing of the file index.php. The manipulation of the argument sml_name/sml_email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.1 is able to address this issue. The identifier of the patch is 484970ef8285cae51d2de3bd4e4684d33c956c28. It is recommended to upgrade the affected component. The identifier VDB-227765 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-05-02T02:15Z
Repository: https://github.com/wp-plugins/mail-subscribe-list
Language: PHP
Files changed: index.php, readme.txt, sml.php
Commit date: 2013-06-09 20:40:26 +0000
Commit message: 2.1 Fix Vulnerability

git-svn-id: https://plugins.svn.wordpress.org/mail-subscribe-list/trunk@724718 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/index.php b/index.php
index 1e38f09..1dc8ef2 100644
--- a/index.php
+++ b/index.php
@@ -87,12 +87,12 @@
 								else {
 									foreach($results as $row) {
 	
 										echo '<tr>
 													<th class="check-column" style="padding:5px 0 2px 0"><input type="checkbox" name="rem[]" value="'.$row->id.'"></th>
-													<td>'.$row->sml_name.'</td>
-													<td>'.$row->sml_email.'</td>
+													<td>'.esc_js(esc_html($row->sml_name)).'</td>
+  													<td>'.esc_js(esc_html($row->sml_email)).'</td>
 											  </tr>';
 											  
 											  
 											  
 	
diff --git a/readme.txt b/readme.txt
index 176fbd6..8651aee 100644
--- a/readme.txt
+++ b/readme.txt
@@ -6,15 +6,15 @@ Requires at least: 3.0
 Tested up to: 3.5.2
 Stable tag: trunk
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
-Simple customisable plugin that displays a name/email form where visitors can submit their information, managable in the WordPress admin.
+Simple customisable plugin that displays a name/email form where visitors can submit their information, manageable in the WordPress admin.
 
 == Description ==
 
-This is a **simple plugin** that allows visitors to enter their name and email address on your website, the visitos details are then added to the subscribers list which is available to view and modify in the WordPress admin area. 
+This is a **simple plugin** that allows visitors to enter their name and email address on your website, the visitors details are then added to the subscribers list which is available to view and modify in the WordPress admin area. 
 
 This plugin can be used not only for Mailing List subscriptions but can be used generally for collecting email address and/or peoples names that are visiting your website.
 
 The name/email form can not only be customised but can also be displayed on any WordPress page by using either the 'Subscribe Widget', WordPress shortcode [smlsubform] or from your WordPress theme by calling the php function.
 
@@ -87,10 +87,14 @@ echo smlsubform($args);</code>
 
 No, this plugin was designed to collect email addresses from visitors. This plugin does not send emails at all.
 
 == Changelog ==
 
+= 2.1
+
+* Critical fix due to vulnerability found and fixed by Falcoz Kevin (aka 0pc0deFR). Thank you.
+
 = 2.0.9 =
 
 * Bug fixes.
 
 = 2.0.8 =
diff --git a/sml.php b/sml.php
index 6698d60..cf12bd9 100644
--- a/sml.php
+++ b/sml.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: Mail Subscribe List
 Plugin URI: http://www.webfwd.co.uk/packages/wordpress-hosting/
 Description: Simple customisable plugin that displays a name/email form where visitors can submit their information, managable in the WordPress admin.
-Version: 2.0.9
+Version: 2.0.10
 Author: Richard Leishman t/a Webforward
 Author URI: http://www.webfwd.co.uk/
 License: GPL
 
 

Vulnerable code: 													<td>'.$row->sml_name.'</td>
													<td>'.$row->sml_email.'</td>
Simple customisable plugin that displays a name/email form where visitors can submit their information, managable in the WordPress admin.
This is a **simple plugin** that allows visitors to enter their name and email address on your website, the visitos details are then added to the subscribers list which is available to view and modify in the WordPress admin area. 
Version: 2.0.9
Fixed code: 													<td>'.esc_js(esc_html($row->sml_name)).'</td>
  													<td>'.esc_js(esc_html($row->sml_email)).'</td>
Simple customisable plugin that displays a name/email form where visitors can submit their information, manageable in the WordPress admin.
This is a **simple plugin** that allows visitors to enter their name and email address on your website, the visitors details are then added to the subscribers list which is available to view and modify in the WordPress admin area. 
= 2.1

* Critical fix due to vulnerability found and fixed by Falcoz Kevin (aka 0pc0deFR). Thank you.

Version: 2.0.10