WordPress Email Subscribers & Newsletters Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is a message push plugin that is used in... A cross-site scripting vulnerability exists in WordPress...

Email Subscribers & Newsletters < 3.5.0 - Cross-Site Scripting (XSS)

Changelog states: "Missing santization in preview template"...

JVN#16471686: WordPress plugin "Email Subscribers & Newsletters" vulnerable to cross-site scripting

The WordPress plugin "Email Subscribers & Newsletters" provided by Icegram contains a reflected cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on a logged in user's web browser. Solution Update the plugin Update the plugin according to the information provid...

WordPress Email Subscribers Newsletters Plugin Information Disclosure (CVE-2018-6015)

An Information Disclosure vulnerability exists in WordPress Email Subscribers & Newsletters plugin. Successful exploitation of this vulnerability would allow a remote attacker to the download the entire e-mail subscriber list from affected system...

WordPress Email Subscribers & Newsletters Plugin Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters plugin is used in one of the push message plugin. An information disclosure vulnerability exists in...

CVE-2018-6015

An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=viewallsubscribers in the body, allows downloading of a CSV data file with all subscriber data...

CVE-2018-6015

An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=viewallsubscribers in the body, allows downloading of a CSV data file with all subscriber data...

Design/Logic Flaw

An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=viewallsubscribers in the body, allows downloading of a CSV data file with all subscriber data...

CVE-2018-6015

The CVE-2018-6015 issue affects WordPress Email Subscribers & Newsletters plugin prior to v3.4.8. An attacker can trigger an information-disclosure by sending an HTTP POST to a URI ending with /?es=export and including option=view_all_subscribers in the body, which allows downloading a CSV contai...

CVE-2018-6015

An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=viewallsubscribers in the body, allows downloading of a CSV data file with all subscriber data...

WordPress Email Subscribers And Newsletters 3.4.7 Information Disclosure

Exploit Title: WordPress Plugin Email Subscribers & Newsletters 3.4.7 - Information Disclosure Google Dork: Date: 2018-01-23 Exploit Author: ThreatPress Security Vendor Homepage: http://icegram.com/ Software Link: https://wordpress.org/plugins/email-subscribers/ Version: 3.4.7 Tested on: WordPres...

Email Subscribers & Newsletters < 3.4.8 - Unauthenticated Subscriber Download

The Email Subscribers & Newsletters – Simple and Effective Email Marketing WordPress Plugin WordPress plugin was affected by an Unauthenticated Subscriber Download security vulnerability. PoC POST /?es=export ... option=viewallsubscribers...

WordPress Plugin Email Subscribers Newsletters 3.4.7 - Information Disclosure

WordPress Plugin Email Subscribers Newsletters 3.4.7 - Information Disclosure Exploit Title: WordPress Plugin Email Subscribers & Newsletters 3.4.7 - Information Disclosure Google Dork: Date: 2018-01-23 Exploit Author: ThreatPress Security Vendor Homepage: http://icegram.com/ Software Link:...

WordPress Email Subscribers & Newsletters 3.4.7 Plugin - Information Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugin Email Subscribers & Newsletters 3.4.7 - Information Disclosure Google Dork: Date: 2018-01-23 Exploit Author: ThreatPress Security Vendor Homepage: http://icegram.com/ Software Link:...

WordPress Plugin Email Subscribers & Newsletters 3.4.7 - Information Disclosure

Exploit Title: WordPress Plugin Email Subscribers & Newsletters 3.4.7 - Information Disclosure Google Dork: Date: 2018-01-23 Exploit Author: ThreatPress Security Vendor Homepage: http://icegram.com/ Software Link: https://wordpress.org/plugins/email-subscribers/ Version: 3.4.7 Tested on: WordPres...

c-and-a.com XSS vulnerability

On the 10.01.2018 security researcher reported a XSS vulnerability affecting the c-and-a.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 10 January, 2018 13:0...

hotedco.com XSS vulnerability

On the 03.01.2018 security researcher reported a XSS vulnerability affecting the hotedco.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 3 January, 2018 18:41...

ubise-officepro.com XSS vulnerability

On the 02.01.2018 security researcher reported a XSS vulnerability affecting the ubise-officepro.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 2 January, 20...

markettex.com XSS vulnerability

On the 02.01.2018 security researcher reported a XSS vulnerability affecting the markettex.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 2 January, 2018 14:...

ravel-orthomedic.com XSS vulnerability

On the 02.01.2018 security researcher reported a XSS vulnerability affecting the ravel-orthomedic.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 2 January,...