CVE-2018-1002005

Severity: medium (CVSS 4.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-03 · updated 2026-06-17
Weakness: CWE-79

Description

These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:43: via the filter_signup_date parameter.

Affected products

Kiboko Labs https://calendarscripts.info/ Arigato Autoresponder and Newsletter: from 2.5.0 before 2.5.1.5 — fixed in 2.5.1.5

How to fix

Upgrade to a fixed version: Kiboko Labs https://calendarscripts.info/ Arigato Autoresponder and Newsletter 2.5.1.5. Check the vendor advisory for mitigations.

References

http://www.vapidlabs.com/advisory.php?v=203
https://wordpress.org/plugins/bft-autoresponder/
https://www.exploit-db.com/exploits/45434/
http://www.vapidlabs.com/advisory.php?v=203
https://wordpress.org/plugins/bft-autoresponder/
https://www.exploit-db.com/exploits/45434/

Get alerted when CVE-2018-1002005 or the next vulnerability affects your stack