CVE-2018-1002006

Severity: medium (CVSS 4.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-03 · updated 2026-06-17
Weakness: CWE-79

Description

These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes

Affected products

Kiboko Labs https://calendarscripts.info/ Arigato Autoresponder and Newsletter: from 2.5.0 before 2.5.1.5 — fixed in 2.5.1.5

How to fix

Upgrade to a fixed version: Kiboko Labs https://calendarscripts.info/ Arigato Autoresponder and Newsletter 2.5.1.5. Check the vendor advisory for mitigations.

References

http://www.vapidlabs.com/advisory.php?v=203
https://wordpress.org/plugins/bft-autoresponder/
https://www.exploit-db.com/exploits/45434/
http://www.vapidlabs.com/advisory.php?v=203
https://wordpress.org/plugins/bft-autoresponder/
https://www.exploit-db.com/exploits/45434/

Get alerted when CVE-2018-1002006 or the next vulnerability affects your stack