EUVD-2026-68778
GHSA-27vc-g94v-rvq2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network-accessible XSS with scope change into victim browser; availability impact removed as script injection does not cause service disruption.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
AnalysisAI
Unauthenticated cross-site scripting in the Email Subscribers & Newsletters WordPress plugin (versions ≤ 5.9.33) by Icegram allows remote, unauthenticated attackers to inject malicious scripts that execute in the browsers of users who visit affected pages. The CVSS scope-change indicator (S:C) confirms the injected payload crosses trust boundaries into the victim's browser context, enabling session hijacking, credential theft, or administrative account takeover on the affected WordPress site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No attacker authentication is required - the CVSS PR:N metric confirms the vulnerable endpoint is accessible to unauthenticated users, consistent with public-facing WordPress plugin forms such as email subscription inputs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 (High) rating is supported by an AV:N/AC:L/PR:N attack path - fully network-accessible with low complexity and no authentication required - which represents a genuine threat, not a theoretical one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Email Subscribers & Newsletters plugin to the version released after 5.9.33 that addresses this XSS; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/email-subscribers/vulnerability/wordpress-email-subscribers-newsletters-plugin-5-9-33-cross-site-scripting-xss-vulnerability should be consulted for the exact fixed version number, which is not confirmed in the currently available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify if Email Subscribers & Newsletters plugin at version 5.9.33 or earlier is deployed and document affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` pa
An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Rated high severity
Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attack
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabil
The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin f
Missing Authorization vulnerability in Email Subscribers & Newsletters.7.13. Rated critical severity (CVSS 9.8), this vu
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress.
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on
Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to ve
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file downloa
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option c
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today