WP-EMail < 2.69.1 - Admin+ Stored Cross-Site Scripting

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. In the "Email Options" section of t...

CVE-2023-23724

Cross-Site Request Forgery CSRF vulnerability in Winwar Media WP Email Capture plugin = 3.9.3 versions...

CVE-2023-23724 WordPress WordPress Email Marketing Plugin – WP Email Capture Plugin <= 3.9.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Winwar Media WP Email Capture plugin = 3.9.3 versions...

CVE-2023-23724: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Winwar Media WP Email Capture plugin = 3.9.3 versions...

PT-2023-19163 · Winwar Media · Wp Email Capture

Name of the Vulnerable Software and Affected Versions: Winwar Media WP Email Capture plugin versions = 3.9.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

CVE-2023-23723

CVE-2023-23723 describes a stored XSS vulnerability in the WordPress plugin “WP Email Capture” by Winwar Media, affecting versions up to 3.9.3. The underlying issue is insufficient sanitization/escaping of certain settings, enabling an attacker with administrator privileges to trigger stored cros...

CVE-2023-23723: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Winwar Media WP Email Capture plugin = 3.9.3 versions...

WP Email Capture < 3.10 - Email Captures Update via CSRF

The plugin does not have CSRF checks when updating its Email Captures, which could allow attackers to make logged in admins perform such action via a CSRF attack...

WordPress plugin WP-EMail has an unspecified vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. WordPress plugin WP-EMail version 2.69.0 has a security vulnerability that stems from obtaining a...

WordPress WP-EMail plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP-EMail plugin versions prior to 2.69.0 are vulnerable to cross-site request forgery, whic...

CVE-2022-1630

The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack...

CVE-2022-1614

The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based anti-spamming restrictions...

Design/Logic Flaw

The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based anti-spamming restrictions...

CVE-2022-1630 WP-Email < 2.69.0 - Log Deletion via CSRF

The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack...

CVE-2022-1630

The WP-EMail WordPress plugin before 2.69.0 is vulnerable to CSRF in log deletion due to missing nonce checks. This allows a logged-in attacker to trick an admin into deleting logs via CSRF. A PoC exists in the WP-Email exploit documentation showing an automatic form submission. Remediation: upgr...

CVE-2022-1614

CVE-2022-1614 affects the WP-EMail WordPress plugin up to version 2.69.0. The root cause is that the plugin prioritizes obtaining a visitor IP from certain HTTP headers (e.g., HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR) over PHP’s REMOTE_ADDR, enabling an attacker to bypass IP-based anti-spam restricti...

CVE-2022-1614 WP-Email < 2.69.0 - Anti-Spam Protection Bypass via IP Spoofing

The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based anti-spamming restrictions...

WordPress plugin WP-EMail 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP-EMail plugin versions prior to 2.69.0 are vulnerable to cross-site request forgery, whic...

CVE-2022-1614: Authorization Bypass Through User-Controlled Key

The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based anti-spamming restrictions...

CVE-2022-1630: Cross-Site Request Forgery (CSRF)

The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack...