WordPress Email Subscribers & Newsletters Elevation of Privilege Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An elevation of privilege vulnerability exis...

WordPress Email Subscribers & Newsletters Unauthenticated Options Creation Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated option creation...

WordPress Email Subscribers & Newsletters Unauthenticated File Download Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated file download vulnerabili...

WordPress Email Subscribers & Newsletters Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. A cross-site request forgery vulnerability...

Unspecified Vulnerability in WordPress Email Subscribers & Newsletters

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. A security vulnerability exists in Email...

Email Subscribers & Newsletters Plugin for WordPress < 4.3.1 Multiple Vulnerabilities

The WordPress Email Subscribers & Newsletters Plugin installed on the remote host is affected by unauthenticated file download, SQL injection, insecure permissions on dashboard and settings, cross-site request forgery on settings and unauthenticated option creation vulnerabilities. Note that the...

VulnCheck KEV: CVE-2019-19985

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...

WordPress Email Subscribers & Newsletters Plugin Multiple Security Bypass Vulnerabilities

Description The Email Subscribers Newsletters Plugin for WordPress is prone to multiple security-bypass vulnerabilities. Attackers can exploit these issues to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. Versions prior to Email Subscriber...

WordPress Email Subscribers and Newsletter Hash SQLi Scanner

Email Subscribers & Newsletters plugin contains an unauthenticated timebased SQL injection in versions before 4.3.1. The hash parameter is vulnerable to injection. Module Options msf use auxiliary/scanner/http/wp/emailsubnewssqli msf undefinedemailsubnewssqli show actions ...actions... msf...

WordPress Email Subscribers & Newsletters plugin <=4.2.2 - Multiple security issues

Multiple security issues found by WordFence in WordPress Email Subscribers & Newsletters plugin versions =4.2.2. Solution Update the WordPress Email Subscribers & Newsletters plugin to the latest available version at least 4.2.3...

WordPress Email Subscribers & Newsletters Plugin Cross Site Request Forgery Vulnerability

Description The Email Subscribers Newsletters Plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. Versions prior to Ema...

WordPress Email Subscribers & Newsletters Plugin CVE-2019-19980 Security Bypass Vulnerability

Description The Email Subscribers Newsletters Plugin for WordPress is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. Versions prior to Email Subscribers Newslette...

Email Subscribers & Newsletters Plugin for WordPress < 4.1.8 SQL Injection

The WordPress Email Subscribers & Newsletters Plugin installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input. A remote attacker can exploit this issue to manipulate SQL queries, resulting in the disclosure of sensitive...

WordPress Email Subscribers & Newsletters plugin <= 4.1.6 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by ivoschyk-cs in WordPress Email Subscribers & Newsletters plugin versions = 4.1.6. Solution Update the WordPress Email Subscribers & Newsletters plugin to the latest available version at least 4.1.7...

WordPress Email Subscribers Plugin < 4.1.7 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112620";...

WordPress Email Subscribers&Newsletters Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers&Newsletters is one of the plug-ins used to push news and information. A cross-site scripting vulnerability exists in...

CVE-2019-14364

An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpxname wp-admin/admin-ajax.php POST parameter...

CVE-2019-14364

An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpxname wp-admin/admin-ajax.php POST parameter...

Cross site scripting

An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpxname wp-admin/admin-ajax.php POST parameter...

CVE-2019-14364

The CVE-2019-14364 entry describes a Cross-Site Scripting (XSS) vulnerability in the WordPress Email Subscribers & Newsletters plugin version 4.1.6. The issue arises from a malicious input via the esfpx_name parameter on the wp-admin/admin-ajax.php endpoint, exposed through a publicly accessible ...