CVE-2021-21418
Potential XSS injection in the newsletter conditions field
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Potential XSS injection in the newsletter conditions field
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
- Record
CVE-2021-21418- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-0883
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
- Record
EUVD-2021-0883- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vwfx-hh3w-fj99
Potential XSS injection in the newsletter conditions field
Impact
An employee can inject javascript in the newsletter condition field that will then be executed on the front office
Patches
The issue has been fixed in 2.6.1
- Record
GHSA-vwfx-hh3w-fj99- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
- Record
CVE-2021-21418- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
- Record
CVE-2021-21418- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-vwfx-hh3w-fj99
Potential XSS injection in the newsletter conditions field
Impact
An employee can inject javascript in the newsletter condition field that will then be executed on the front office
Patches
The issue has been fixed in 2.6.1
- Record
GHSA-vwfx-hh3w-fj99- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prestashop/ps_emailsubscriptionPackagist |
before 2.6.1 | 2.6.1 |
prestashop/ps_emailsubscriptionPackagist |
before 2.6.1, plus listed versions v1.0.1v1.1.0v1.1.1v1.1.2v1.1.6 Show 5 moreShow lessv2.1.0v2.2.0v2.3.0v2.5.0v2.6.0 |
2.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21418 is a medium vulnerability (CVSS 4.6) in Prestashop Ps Emailsubscription, published March 31, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in prestashop/ps_emailsubscription 2.6.1.
References
github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99
packagist.org/packages/prestashop/ps_emailsubscription
nvd.nist.gov/vuln/detail/CVE-2021-21418