$1,250 Bounty Awarded for Unauthenticated SQL Injection Vulnerability Patched in Email Subscribers by Icegram Express WordPress Plugin

🎉 Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! On March 25th, 2024, during our second Bug Bounty Extravaganza, w...

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin < 5.7.15 - Unauthenticated SQL Injection

Description The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficie...

PT-2024-22566 · Icegram Express · Email Subscribers

Name of the Vulnerable Software and Affected Versions: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress versions up to, and including, 5.7.14 Description: The issue is related to SQL Injection via the run function of...

CVE-2024-2341

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

PT-2024-18649 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Video Conferencing with Zoom plugin for WordPress versions up to and including 4.4.5 Description: The issue allows authenticated attackers with subscriber access or higher to expose sensitive information, including usernames, emails, and IDs ...

PT-2024-18185 · WordPress · 360 Javascript Viewer

Name of the Vulnerable Software and Affected Versions: 360 Javascript Viewer plugin for WordPress versions prior to 1.7.13 Description: The issue allows authenticated attackers with subscriber access or higher to update plugin settings due to a missing capability check and nonce exposure on sever...

WordPress Image Watermark plugin <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Watermark Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Watermark Modification vulnerability discovered by Lucio Sá in WordPress Plugin Image Watermark versions = 1.7.3...

CVE-2024-2656

CVE-2024-2656: Icegram Express Email Subscribers for WordPress contains Stored XSS via CSV import in all versions up to 5.7.14. Exploitation requires authenticated admin-level access (plus). Affected on multi-site installations and where unfiltered_html is disabled; root cause is insufficient inp...

CVE-2024-2656 Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a CSV import in all versions up to, and including, 5.7.14 due to insufficient input sanitization and output escapin...

WordPress Plugin Email Subscribers by Icegram Express 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in WordPress Plugin Email...

WordPress Email Subscribers & Newsletters Plugin <= 5.7.13 is vulnerable to Broken Access Control

Software Email Subscribers & Newsletters Type Plugin Vulnerable versions = 5.7.13 Fixed in 5.7.14 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31352 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 1e92fe5167c9 Credits Mika Requir...

Icegram Express < 5.7.16 - Authenticated (Administrator+) Cross-Site Scripting via CSV import

Description The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a CSV import in all versions up to, and including, 5.7.14 due to insufficient input sanitization and...

Better Comments < 1.5.6 - Subscriber+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow low privilege users such as Subscribers to perform Stored Cross-Site Scripting attacks. PoC 1. From the menu on the left, go into "Users" and edit Subscriber user. 2. Upload a new avatar image and click...

CVE-2024-22300

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Icegram Email Subscribers & Newsletters allows Reflected XSS.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.11...

CVE-2024-22300

CVE-2024-22300: Icegram Email Subscribers & Newsletters plugin for WordPress contains a Reflected XSS in input handling that affects versions from unknown up to 5.7.11. Public details in the connected documents confirm the vulnerability type and affected version ceiling but do not specify root ca...

CVE-2024-22300 WordPress Icegram Express plugin <= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Icegram Email Subscribers & Newsletters allows Reflected XSS.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.11...

CVE-2024-22300 WordPress Icegram Express plugin <= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Icegram Email Subscribers & Newsletters allows Reflected XSS.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.11...

WholesaleX < 1.3.2 - Sensitive Information Exposure via export_users

Description The WholesaleX – WooCommerce Wholesale Plugin Wholesale Prices, Dynamic Pricing, Tiered Pricing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the 'exportusers'. This makes it possible for authenticated attackers,...

WordPress Plugin Email Subscribers by Icegram Express 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

YouTube ordered to reveal the identities of video viewers

Federal US authorities have asked Google for the names, addresses, telephone numbers, and user activity of accounts that watched certain YouTube videos, according to unsealed court documents Forbes has seen. Of those users that weren’t logged in when they watched those videos between January 1 an...