email subscribers vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv2

Cross-site scripting vulnerability in Email Subscribers & Newsletters versions before 3.5.0 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.

Email Subscribers \\& Newsletters Project Email Subscribers \\& Newsletters

5

CVSSv2

An issue exists in the "Email Subscribers & Newsletters" plugin prior to 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscr...

Icegram Email Subscribers \\& Newsletters

5

CVSSv2

Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated malicious user to conduct unauthenticated email forgery/spoofing.

Icegram Email Subscribers \\& Newsletters

4

CVSSv2

The WordPress plugin, Email Subscribers & Newsletters, prior to 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugi...

Icegram Email Subscribers \\& Newsletters

4.3

CVSSv2

The WordPress plugin, Email Subscribers & Newsletters, prior to 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.

Icegram Email Subscribers \\& Newsletters

5

CVSSv2

The WordPress plugin, Email Subscribers & Newsletters, prior to 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&option_name= request.

Icegram Email Subscribers \\& Newsletters

6.5

CVSSv2

The WordPress plugin, Email Subscribers & Newsletters, prior to 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns.

Icegram Email Subscribers \\& Newsletters

5

CVSSv2

The WordPress plugin, Email Subscribers & Newsletters, prior to 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.

Icegram Email Subscribers \\& Newsletters

1 Github repository

NA

The Icegram Express WordPress plugin prior to 5.5.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber

Icegram Email Subscribers \\& Newsletters

6.5

CVSSv2

The Email Subscribers & Newsletters WordPress plugin prior to 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it...

Icegram Email Subscribers \\& Newsletters

1 Github repository

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook