CVE-2022-0439

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

CVE-2024-12568

CVE-2024-12568 affects the WordPress plugin “Email Subscribers by Icegram Express” (pre-5.7.45). The issue is a Stored XSS vulnerability caused by insufficient sanitization/escaping of Workflow settings, exploitable by high-privilege users (e.g., admins), and can occur even when unfiltered_html i...

CVE-2024-12566 Email Subscribers < 5.7.45 - Admin+ Stored XSS

The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...