Code injection

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

Privilege escalation

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...

CVE-2019-19980

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...

CVE-2019-19980

The CVE-2019-19980 entry concerns the WordPress plugin Email Subscribers & Newsletters prior to version 4.2.3. Root cause: the plugin registers a wp_ajax send_test_email function, enabling a privilege-bypass that lets authenticated users (Subscriber and higher) send test emails from the admin das...

CVE-2019-19981

CVE-2019-19981 affects the WordPress plugin Email Subscribers & Newsletters (before 4.2.3). The vulnerability is a CSRF flaw that can be exploited to impact all plugin settings. Remediation observed in public sources is to update to version 4.2.3 or later. Additional connected feeds note broader ...

CVE-2019-19982

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

CVE-2019-19982

The CVE-2019-19982 entry concerns the WordPress plugin Email Subscribers & Newsletters prior to version 4.2.3 . The vulnerability allows unauthenticated option creation when an attacker sends a request to /wp-admin/admin-post.php?es_skip=1&option_name= , enabling modification of plugin options wi...

CVE-2019-19984

The CVE-2019-19984 entry describes a vulnerability in the WordPress plugin Email Subscribers & Newsletters before version 4.2.3 where users with edit_post privileges could manage plugin settings and email campaigns. The issue is a privilege/AC (access control) weakness allowing low-privilege user...

CVE-2019-19984

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

CVE-2019-19985

CVE-2019-19985 concerns the WordPress plugin Email Subscribers & Newsletters (before 4.2.3). The issue allows unauthenticated arbitrary file retrieval, enabling file download and user information disclosure. Connections in the provided documents confirm the vulnerability affects versions prior to...

WordPress Email Subscribers & Newsletters Unauthenticated Options Creation Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated option creation...

WordPress Email Subscribers & Newsletters Elevation of Privilege Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An elevation of privilege vulnerability exis...

Unspecified Vulnerability in WordPress Email Subscribers & Newsletters

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. A security vulnerability exists in Email...

WordPress Email Subscribers & Newsletters Unauthenticated File Download Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated file download vulnerabili...

WordPress Email Subscribers & Newsletters Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. A cross-site request forgery vulnerability...

Email Subscribers & Newsletters Plugin for WordPress < 4.3.1 Multiple Vulnerabilities

The WordPress Email Subscribers & Newsletters Plugin installed on the remote host is affected by unauthenticated file download, SQL injection, insecure permissions on dashboard and settings, cross-site request forgery on settings and unauthenticated option creation vulnerabilities. Note that the...

WordPress Email Subscribers & Newsletters Plugin Multiple Security Bypass Vulnerabilities

Description The Email Subscribers Newsletters Plugin for WordPress is prone to multiple security-bypass vulnerabilities. Attackers can exploit these issues to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. Versions prior to Email Subscriber...

VulnCheck KEV: CVE-2019-19985

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...

WordPress Email Subscribers and Newsletter Hash SQLi Scanner

Email Subscribers & Newsletters plugin contains an unauthenticated timebased SQL injection in versions before 4.3.1. The hash parameter is vulnerable to injection. Module Options msf use auxiliary/scanner/http/wp/emailsubnewssqli msf undefinedemailsubnewssqli show actions ...actions... msf...

WordPress Email Subscribers & Newsletters plugin <=4.2.2 - Multiple security issues

Multiple security issues found by WordFence in WordPress Email Subscribers & Newsletters plugin versions =4.2.2. Solution Update the WordPress Email Subscribers & Newsletters plugin to the latest available version at least 4.2.3...