CVE-2024-8254 — Code Injection in Email Subscribers Newsletters

CWE-94 — Code Injection3 documents3 sources
Severity
6.3MEDIUMNVD
CNA5.4
EPSS
0.3%
top 47.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Icegram Email Subscribers Newsletters
Timeline
PublishedOct 2

Description

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages1 packages

Patches

Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution↗2024-10-02
▶
GHSA
GHSA-2rv6-9vgp-q3xf: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to↗2024-10-02
▶
CVE-2024-8254 — Code Injection | cvebase