CVE-2024-4295

🗓️ 05 Jun 2024 05:33:05Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 124 Views🌐 WEB

CVE-2024-4295 vulnerability in NVD

Reporter	Title	Published	Views	Family All 15
BDU FSTEC	The vulnerability of the plugin for Email Subscribers in the WordPress content management system allows a hacker to add additional SQL queries to existing ones and exploit the vulnerable information.	14 Jun 202400:00	–	bdu_fstec
Circl	CVE-2024-4295	5 Jun 202410:32	–	circl
Cvelist	CVE-2024-4295 Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash	5 Jun 202405:33	–	cvelist
Nuclei	Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash	27 Jun 202603:01	–	nuclei
NVD	CVE-2024-4295	5 Jun 202406:15	–	nvd
OSV	CVE-2024-4295	5 Jun 202406:15	–	osv
Patchstack	WordPress Email Subscribers by Icegram Express plugin <= 5.7.20 - Unauthenticated SQL Injection via hash vulnerability	5 Jun 202403:00	–	patchstack
Patchstack	WordPress Email Subscribers & Newsletters Plugin <= 5.7.20 is vulnerable to SQL Injection	5 Jun 202400:00	–	patchstack
RedhatCVE	CVE-2024-4295	5 Feb 202500:02	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2024-4295	23 Apr 202500:00	–	vulncheck_kev

NVD

Vulners

Node

icegram email_subscribers_&_newslettersRange<5.7.21wordpress

[
  {
    "vendor": "icegram",
    "product": "Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.7.20",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/641123af-1ec6-4549-a58c-0a08b4678f45
plugins	www.plugins.trac.wordpress.org/changeset/3090845/email-subscribers/trunk/lite/includes/db/class-es-db-lists-contacts.php

Parameter	Position	Path	Description	CWE
hash	request body	/wp-admin/admin-ajax.php	SQL Injection via hash parameter in Email Subscribers by Icegram Express plugin for WordPress (unauthenticated).	CWE-89

17 Jun 2026 08:01Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.10161

SSVC

CWE-89