CVE-2024-2876

CVE-2024-2876 - Vulnerabilidad de inyección SQL en Email Subscribers by Icegram Express Descripción general CVE-2024-2876 es una vulnerabilidad de seguridad crítica encontrada en el plugin "Email Subscribers by Icegram Express" para WordPress. Esta vulnerabilidad afecta a versiones hasta la 5.7.1...

EUVD-2026-91188

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option...

wordpress-exploits

wordpress-exploits Exploits aleatorios de WordPress pueden o no funcionar. CVE-2019-19985 Información Description: Unauthenticated File Download w/ Information Disclosure CVE ID: CVE-2019-19985 CVSS v3.0 Score: 5.8 Medium CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Affected...

CVE-2021-25076

CVE-2021-25076-Exploit Plugin de WordPress WP User Frontend 3.5.26 - Inyección SQL Autenticado Descripción del CVE: El plugin de WordPress WP User Frontend anterior a la versión 3.5.26 no valida ni escapa el parámetro status antes de usarlo en una sentencia SQL en el panel de Suscriptores, lo que...

Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash

Email Subscribers by Icegram Express = 5.7.20 contains an unauthenticated SQL injection vulnerability via the hash parameter. id: CVE-2024-4295 info: name: Email Subscribers by Icegram Express = 5.7.20 - Unauthenticated SQL Injection via Hash author: iamnoooob,rootxharsh,pdresearch severity:...

Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting

The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. id: CVE-2017-18502 info: name: Subscriber by BestWebSoft 1.3.5 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. impact: |...

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

EUVD-2025-209819

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the createadvertiser AJAX action in all versions up to, and including, 1.53.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create...

CVE-2026-97074 WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

CVE-2024-2876

CVE-2024-2876 Descripción de la vulnerabilidad: El plugin Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce para WordPress es vulnerable a inyección SQL a través de la función 'run' de la clase 'IGESSubscribersQuery' en todas las versiones...

CVE-2024-4295-Poc

CVE-2024-4295-Poc CVE-2024-4295 Email Subscribers by Icegram Express editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT Hubo una falla en el plugin de WordPress, Email Subscribers & Newsletters anterior a la versión 4.3.1, que permitía pasar sentencias SQL a la base de datos en el parámetro hash una vulnerabilidad de inyección SQL ciega. Este script es una "versión saneada" del script origin...

CVE-2024-4295-Poc

CVE-2024-4295-Poc CVE-2024-4295 Email Subscribers by Icegram Express editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...

CVE-2024-2876

CVE-2024-2876 - Vulnerabilidad de Inyección SQL en Email Subscribers by Icegram Express Resumen CVE-2024-2876 es una vulnerabilidad de seguridad crítica encontrada en el plugin "Email Subscribers by Icegram Express" para WordPress. Esta vulnerabilidad afecta a las versiones hasta la 5.7.14...

CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Inyección SQL ciega de Subscriber+ Requisitos sqlmap instalado y un nombre de usuario y contraseña válidos con subscriber+ Uso usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message...

CVE-2023-5070

CVE-2023-5070 Botones para Compartir en Redes Sociales e Iconos para Compartir en Redes Sociales = 2.8.5 - Exposición de Información Descripción: El plugin Social Media Share Buttons & Social Sharing Icons para WordPress es vulnerable a Exposición de Información Sensible en versiones hasta la 2.8...

PT-2026-97709

Name of the Vulnerable Software and Affected Versions Masteriyo LMS versions prior to 3.4.2 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if the authenticated user requesting course-progress records is the actual owner of those records. This allows...

CVE-2026-83555

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

CVE-2026-83555

The Email Subscribers & Newsletters WordPress plugin (versions before 5.9.35 ) is vulnerable to an unauthenticated subscription status change . The root cause is a failure to verify the per-subscriber management token when updating subscription statuses. This allows unauthenticated users to force...