2549 matches found
CVE-2024-2876
CVE-2024-2876 취약점 설명: WordPress용 Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce 플러그인은 사용자가 제공한 매개변수에 대한 이스케이프 처리 부족과 기존 SQL 쿼리에 대한 충분한 준비preparation 부족으로 인해 5.7.14를 포함한 모든 버전에서 ‘IGESSubscribersQuery’ 클래스의 ‘run’ 함수를 통한 SQL 인젝션에 취약합니다. 이로...
CVE-2026-15797: Improper Neutralization of Input During Web Page Generation
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-87915: Improper Neutralization of Input During Web Page Generation
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...
CVE-2026-86781
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...
CVE-2026-86781
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin, in versions before 4.7.40 , is vulnerable to unauthorized data disclosure. The root cause is a lack of capability or nonce checks on a certificate-file download routine that executes early in the WordPress admin request l...
CVE-2026-88871
WWBN AVideo 's CustomizeUser plugin (enabled by default) contains a CSRF vulnerability in the setSubscribers.json.php endpoint, affected through commit c3edcc274c (master, 2026-08-23). The endpoint reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without re...
WordPress Email Subscribers & Newsletters plugin <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field vulnerability
Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field vulnerability discovered by Sander Horsman - Conda Security in WordPress Plugin Email Subscribers & Newsletters versions = 5.9.27...
CVE-2026-12757
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2026-12757 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2026-12757 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
EUVD-2026-72402
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2026-12757
The Email Subscribers & Newsletters WordPress plugin is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 5.9.27 . The root cause is that the plugin's subscription-handling logic does not properly validate user-supplied input (the subscriber name fiel...
CVE-2026-12757: Improper Control of Generation of Code
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
PT-2026-86803
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2026-84935: Improper Neutralization of Input During Web Page Generation
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...
CVE-2026-84934: Improper Neutralization of Input During Web Page Generation
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...
CVE-2026-81290
Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...
CVE-2026-81290 WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...
CVE-2026-81290
CVE-2026-81290 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Email Subscribers & Newsletters , affecting versions ≤ 5.9.33 . The vulnerability was discovered by Jiemook and rated CVSS 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicat...