CVE-2024-12567: Email Subscribers < 5.7.45 - Admin+ Stored XSS
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12567?
CVE-2024-12567 is considered a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-12567?
To fix CVE-2024-12567, update the Email Subscribers by Icegram Express plugin to version 5.7.45 or later.
Who is affected by CVE-2024-12567?
CVE-2024-12567 affects users of the Email Subscribers by Icegram Express WordPress plugin prior to version 5.7.45.
What type of vulnerability is CVE-2024-12567?
CVE-2024-12567 is a Stored Cross-Site Scripting (XSS) vulnerability.
Can lower privilege users exploit CVE-2024-12567?
No, CVE-2024-12567 requires high privilege users, such as administrators, to exploit the vulnerability.