CVE-2024-12567: The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored

medium Affects email-subscribers-\&-newsletters (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2025-01-13; advisory modified 2026-06-17.

The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored

Package: email-subscribers-\&-newsletters (WordPress plugin) WordPress
Affected versions: <5.7.45
Fixed in: 5.7.45
Severity: medium CVSS 4.8
Exploitation: not on CISA KEV · EPSS 0% (24.0th percentile)
Published: 2025-01-13
Source: nvd

References

https://wpscan.com/vulnerability/82051ccc-c528-4ff3-900a-3b8e8ad34145/

CWE-79

NVD record email-subscribers-\&-newsletters (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2019-20361 critical There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, th same package: email-subscribers-\&-newsletters (WordPress plugin)
CVE-2019-19985 medium The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowe same package: email-subscribers-\&-newsletters (WordPress plugin)
CVE-2022-0439 high The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escap same package: email-subscribers-\&-newsletters (WordPress plugin)
CVE-2020-5768 medium Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Ic same package: email-subscribers-\&-newsletters (WordPress plugin)
CVE-2020-5780 medium Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Pl same package: email-subscribers-\&-newsletters (WordPress plugin)
CVE-2019-19982 medium The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowe same package: email-subscribers-\&-newsletters (WordPress plugin)