2381 matches found
CVE-2019-20361-EXPLOIT
CVE-2019-20361-EXPLOIT Hubo una falla en el plugin de WordPress, Email Subscribers & Newsletters anterior a la versión 4.3.1, que permitía pasar sentencias SQL a la base de datos en el parámetro hash una vulnerabilidad de inyección SQL ciega. Este script es una "versión saneada" del script origin...
CVE-2026-12757
The Email Subscribers & Newsletters WordPress plugin is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 5.9.27 . The root cause is that the plugin's subscription-handling logic does not properly validate user-supplied input (the subscriber name fiel...
EUVD-2026-72402
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2024-2876
CVE-2024-2876 - Vulnerabilidad de inyección SQL en Email Subscribers by Icegram Express Descripción general CVE-2024-2876 es una vulnerabilidad de seguridad crítica encontrada en el plugin "Email Subscribers by Icegram Express" para WordPress. Esta vulnerabilidad afecta a versiones hasta la 5.7.1...
CVE-2024-4295-Poc
CVE-2024-4295-Poc CVE-2024-4295 Icegram Express 的 Email Subscribers 插件 editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...
Wordpress Email Subscribers by Icegram Express - SQL Injection
The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...
Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash
Email Subscribers by Icegram Express = 5.7.20 contains an unauthenticated SQL injection vulnerability via the hash parameter. id: CVE-2024-4295 info: name: Email Subscribers by Icegram Express = 5.7.20 - Unauthenticated SQL Injection via Hash author: iamnoooob,rootxharsh,pdresearch severity:...
Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. id: CVE-2017-18502 info: name: Subscriber by BestWebSoft 1.3.5 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. impact: |...
Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...
CVE-2021-25076
CVE-2021-25076-Exploit WordPress 插件 WP User Frontend 3.5.26 - SQL 注入（已认证） CVE 描述： WP User Frontend WordPress 插件在 3.5.26 之前的版本中，在订阅者仪表盘（Subscribers dashboard）的 SQL 语句中使用 status 参数之前，未对其进行校验和转义，从而导致 SQL 注入。 由于缺乏清洗和转义，这也可能导致反射型跨站脚本攻击（XSS）。 https://nvd.nist.gov/vuln/detail/CVE-2021-25076 ExploitDB：...
CVE-2024-4295-Poc
CVE-2024-4295-Poc CVE-2024-4295 Email Subscribers by Icegram Express editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...
CVE-2024-2876
CVE-2024-2876 漏洞描述： Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce 插件（适用于 WordPress）在版本 5.7.14 及之前的所有版本中，由于对用户提供的参数转义不足，且未对现有 SQL 查询进行充分预处理，导致通过 IGESSubscribersQuery 类的 run 函数存在 SQL 注入漏洞。这使得未经认证的攻击者能够将额外的 SQL 查询附加到已有查询中，从而提取数据库中的敏感信息。...
CVE-2024-2876
CVE-2024-2876 - Vulnerabilidad de Inyección SQL en Email Subscribers by Icegram Express Resumen CVE-2024-2876 es una vulnerabilidad de seguridad crítica encontrada en el plugin "Email Subscribers by Icegram Express" para WordPress. Esta vulnerabilidad afecta a las versiones hasta la 5.7.14...
CVE-2023-5070
CVE-2023-5070 社交媒体分享按钮和社交分享图标 = 2.8.5 - 信息泄露 描述： WordPress 的社交媒体分享按钮和社交分享图标插件在版本 2.8.5 及以下版本中，通过 sfsisaveexport 函数存在敏感信息泄露漏洞。这允许订阅者导出包含社交媒体身份验证令牌、机密以及应用密码的插件设置。 root@kitploit: Severity: medium CVE ID: CVE-2023-5070 CVSS Score: 6.5 CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Plugin...
wordpress-exploits
wordpress-exploits Exploits aleatorios de WordPress pueden o no funcionar. CVE-2019-19985 Información root@kitploit: Description: Unauthenticated File Download w/ Information Disclosure CVE ID: CVE-2019-19985 CVSS v3.0 Score: 5.8 Medium CVSS Vector String:...
CVE-2022-0439
CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ 盲SQL注入 必备条件 已安装 sqlmap，并拥有一个具备 subscriber+ 权限的有效用户名和密码 用法 root@kitploit: usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w URL, --url URL URL of the...
CVE-2026-81290
Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...
EUVD-2026-68778
Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...
CVE-2026-81290
CVE-2026-81290 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Email Subscribers & Newsletters , affecting versions ≤ 5.9.33 . The vulnerability was discovered by Jiemook and rated CVSS 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicat...
