CVE-2021-21418 json
Potential XSS injection in the newsletter conditions field
published 2021-03-31 5 y ago modified 2026-07-08 4 mo ago also GHSA-vwfx-hh3w-fj99 , EUVD-2021-0883
- cvss
- 4.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
Patch / fix
- packagist prestashop/ps_emailsubscription 2.6.1
- prestashop ps_emailsubscription 2.6.1
Exploit prediction
0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| GitHub | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | prestashop/ps_emailsubscription | <2.6.1 |
2.6.1 |
Affected products
- PrestaShop ps_emailsubscription
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70
web, patch, third-party-advisory
-
github.com
/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99
web, third-party-advisory
-
github.com
/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1
web, release-notes, third-party-advisory
-
packagist.org
/packages/prestashop/ps_emailsubscription
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-21418
advisory
Sources
- CVE List CVE-2021-21418
- GitHub Advisory GHSA-vwfx-hh3w-fj99
- NVD CVE-2021-21418
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.