CVE-2024-12567

The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-12567

creationtimestamp| type| source ---|---|--- 2025-01-13 06:05:09+00:00| seen| https://infosec.exchange/users/cve/statuses/113819537173124576 2025-01-13 06:05:58+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/1352 2025-01-13 06:10:26+00:00| seen|...

CVE-2024-12567 Email Subscribers < 5.7.45 - Admin+ Stored XSS

The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-12567

CVE-2024-12567 – Icegram Express Email Subscribers (WP plugin) prior to 5.7.45 stores and escapes settings poorly, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disabled. Impact described in sources as admin-level Stored XSS within form settings, multisit...