CVE-2019-19984

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

CVE-2019-19984

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

CVE-2019-19982

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

CVE-2019-19981

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings...

CVE-2019-19982

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

CVE-2019-19985

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...

CVE-2019-19981

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings...

Design/Logic Flaw

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

Cross site request forgery (csrf)

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings...

Information disclosure

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...

Privilege escalation

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...

Code injection

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

CVE-2019-19980

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...

CVE-2019-19980

The CVE-2019-19980 entry concerns the WordPress plugin Email Subscribers & Newsletters prior to version 4.2.3. Root cause: the plugin registers a wp_ajax send_test_email function, enabling a privilege-bypass that lets authenticated users (Subscriber and higher) send test emails from the admin das...

CVE-2019-19981

CVE-2019-19981 affects the WordPress plugin Email Subscribers & Newsletters (before 4.2.3). The vulnerability is a CSRF flaw that can be exploited to impact all plugin settings. Remediation observed in public sources is to update to version 4.2.3 or later. Additional connected feeds note broader ...

CVE-2019-19982

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

CVE-2019-19982

The CVE-2019-19982 entry concerns the WordPress plugin Email Subscribers & Newsletters prior to version 4.2.3 . The vulnerability allows unauthenticated option creation when an attacker sends a request to /wp-admin/admin-post.php?es_skip=1&option_name= , enabling modification of plugin options wi...

CVE-2019-19984

The CVE-2019-19984 entry describes a vulnerability in the WordPress plugin Email Subscribers & Newsletters before version 4.2.3 where users with edit_post privileges could manage plugin settings and email campaigns. The issue is a privilege/AC (access control) weakness allowing low-privilege user...

CVE-2019-19984

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

CVE-2019-19985

CVE-2019-19985 concerns the WordPress plugin Email Subscribers & Newsletters (before 4.2.3). The issue allows unauthenticated arbitrary file retrieval, enabling file download and user information disclosure. Connections in the provided documents confirm the vulnerability affects versions prior to...