Unknown Email Subscribers By Icegram Express vulnerabilities
5 known vulnerabilities affecting unknown/email_subscribers_by_icegram_express.
Total CVEs
5
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM5
Vulnerabilities
Page 1 of 1
CVE-2024-12566MEDIUMCVSS 4.8fixed in 5.7.452025-01-13
CVE-2024-12566 [MEDIUM] CWE-79 CVE-2024-12566: The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escap
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
cvelistv5nvd
CVE-2024-11636MEDIUMCVSS 4.8fixed in 5.7.452025-01-13
CVE-2024-11636 [MEDIUM] CWE-20 CVE-2024-11636: The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escap
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
cvelistv5nvd
CVE-2024-12568MEDIUMCVSS 4.8fixed in 5.7.452025-01-13
CVE-2024-12568 [MEDIUM] CWE-79 CVE-2024-12568: The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escap
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
cvelistv5nvd
CVE-2024-12567MEDIUMCVSS 4.8fixed in 5.7.452025-01-13
CVE-2024-12567 [MEDIUM] CWE-79 CVE-2024-12567: The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escap
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
cvelistv5nvd
CVE-2024-12311MEDIUMCVSS 6.5fixed in 5.7.442025-01-06
CVE-2024-12311 [MEDIUM] CWE-89 CVE-2024-12311: The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escap
The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
cvelistv5nvd