HomeWordPress vulnerabilitiesEmail Subscribers & Newsletters
Email Subscribers & Newsletters vulnerabilities
Email Subscribers & Newsletters has 23 known vulnerabilities in this database. The most recent published record is dated 23 Sep 2026.
- Known vulnerabilities
- 23
- Active installs
- 50,000+
- Latest version
- 5.9.38
- Last updated
- 1 Oct 2026
- Most recent
- 23 Sep 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Broken access control CVE-2026-83555 | Medium 5.3 | Before 5.9.35 | Fixed in 5.9.35 | 23 Sep 2026 |
| Remote code execution CVE-2026-12757 | Medium 6.5 | Up to 5.9.27 | Fixed in a later version (latest 5.9.38) | 7 Sep 2026 |
| Broken access control CVE-2026-11592 | Medium 4.3 | Up to 5.9.27 | Fixed in a later version (latest 5.9.38) | 2 Jul 2026 |
| SQL injection CVE-2026-1651 | Medium 6.5 | Up to 5.9.16 | Fixed in a later version (latest 5.9.38) | 4 Mar 2026 |
| Broken access control CVE-2025-12348 | Medium 5.3 | Up to 5.9.10 | Fixed in a later version (latest 5.9.38) | 12 Dec 2025 |
| Authentication bypass CVE-2025-12349 | Medium 5.3 | Up to 5.9.10 | Fixed in a later version (latest 5.9.38) | 19 Nov 2025 |
| Remote code execution CVE-2024-8254 | Medium 5.4 | Before 5.7.35 | Fixed in 5.7.35 | 2 Oct 2024 |
| Broken access control CVE-2024-8771 | Medium 4.3 | Before 5.7.35 | Fixed in 5.7.35 | 26 Sep 2024 |
| Broken access control CVE-2024-5703 | Medium 4.3 | Before 5.7.27 | Fixed in 5.7.27 | 17 Jul 2024 |
| SQL injection CVE-2024-6172 | Critical 9.8 | Before 5.7.26 | Fixed in 5.7.26 | 2 Jul 2024 |
| SQL injection CVE-2024-5756 | Critical 9.8 | Before 5.7.24 | Fixed in 5.7.24 | 21 Jun 2024 |
| SQL injection CVE-2024-4845 | High 8.8 | Before 5.7.23 | Fixed in 5.7.23 | 12 Jun 2024 |
| SQL injection CVE-2024-4295 | Critical 9.8 | Before 5.7.21 | Fixed in 5.7.21 | 5 Jun 2024 |
| Broken access control CVE-2024-3626 | Medium 4.3 | Up to 5.7.17 | Fixed in a later version (latest 5.9.38) | 23 May 2024 |
| SQL injection CVE-2024-4010 | High 8.8 | Up to 5.7.19 | Fixed in a later version (latest 5.9.38) | 15 May 2024 |
| SQL injection CVE-2024-2876 | Critical 9.8 | Up to 5.7.14 | Fixed in a later version (latest 5.9.38) | 2 May 2024 |
| Cross-site scripting (XSS) CVE-2024-2656 | Medium 4.4 | Up to 5.7.14 | Fixed in a later version (latest 5.9.38) | 6 Apr 2024 |
| CSV injection CVE-2022-45810 | Medium 4.7 | Up to 5.5.2 | Fixed in a later version (latest 5.9.38) | 7 Nov 2023 |
| Path traversal CVE-2023-5414 | Critical 9.1 | Up to 5.6.23 | Fixed in a later version (latest 5.9.38) | 20 Oct 2023 |
| SQL injection CVE-2022-0439 | High 8.8 | Before 5.3.2 | Fixed in 5.3.2 | 7 Mar 2022 |
| Cross-site scripting (XSS) CVE-2019-14364 | Medium 6.1 | Not yet published | Check for an update | 28 Jul 2019 |
| SQL injection CVE-2019-13569 | Critical 9.8 | Up to 4.1.7 | Fixed in a later version (latest 5.9.38) | 19 Jul 2019 |
| Sensitive data exposure CVE-2018-6015 | High 7.5 | Before 3.4.8 | Fixed in 3.4.8 | 26 Jan 2018 |
Read the published descriptions
- CVE-2026-83555, 23 Sep 2026
- The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know. CVE record
- CVE-2026-12757, 7 Sep 2026
- The The Email Subscribers & Newsletters - Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. CVE record
- CVE-2026-11592, 2 Jul 2026
- The Email Subscribers & Newsletters - Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite plugin mail settings (from name and from email address), create audience lists, insert arbitrary contacts into those lists, create and overwrite newsletter broadcasts and post notifications, add workflows, and queue and dispatch mass email to arbitrary recipients. CVE record
- CVE-2026-1651, 4 Mar 2026
- The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the 'workflow_ids' parameter in all versions up to, and including, 5.9.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2025-12348, 12 Dec 2025
- The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `run_action_scheduler_task` function. This makes it possible for unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs, potentially triggering email sends, maintenance tasks, or other privileged operations, causing unexpected state changes and resource usage. CVE record
- CVE-2025-12349, 19 Nov 2025
- The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `trigger_mailing_queue_sending` function. This makes it possible for unauthenticated attackers to force immediate email sending, bypass the schedule, increase server load, and change plugin state (e.g., last-cron-hit), enabling abuse or DoS-like effects. CVE record
- CVE-2024-8254, 2 Oct 2024
- The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. CVE record
- CVE-2024-8771, 26 Sep 2024
- The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'preview_email_template_design' function in all versions up to, and including, 5.7.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the content of private, password protected, pending, and draft posts and pages. CVE record
- CVE-2024-5703, 17 Jul 2024
- The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized API access due to a missing capability check in all versions up to, and including, 5.7.26. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access the API (provided it is enabled) and add, edit, and delete audience users. CVE record
- CVE-2024-6172, 2 Jul 2024
- The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-37252 appears to be a duplicate of this issue. CVE record
- CVE-2024-5756, 21 Jun 2024
- The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2024-4845, 12 Jun 2024
- The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’ parameter in all versions up to, and including, 5.7.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2024-4295, 5 Jun 2024
- The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, and including, 5.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2024-3626, 23 May 2024
- The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_template_content function in all versions up to, and including, 5.7.17. This makes it possible for authenticated attackers, with subscriber access and above, to obtain the contents of private and password-protected posts. CVE record
- CVE-2024-4010, 15 May 2024
- The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the handle_ajax_request function in all versions up to, and including, 5.7.19. This makes it possible for authenticated attackers, with subscriber-level access and above, to cause a loss of confidentiality, integrity, and availability, by performing multiple unauthorized actions. Some of these actions could also be leveraged to conduct PHP Object Injection and SQL Injection attacks. CVE record
- CVE-2024-2876, 2 May 2024
- The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2024-2656, 6 Apr 2024
- The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a CSV import in all versions up to, and including, 5.7.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE record
- CVE-2022-45810, 7 Nov 2023
- Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express - Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express - Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2. CVE record
- CVE-2023-5414, 20 Oct 2023
- The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including those belonging to other sites, for example in shared hosting environments. CVE record
- CVE-2022-0439, 7 Mar 2022
- The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link. CVE record
- CVE-2019-14364, 28 Jul 2019
- An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter. CVE record
- CVE-2019-13569, 19 Jul 2019
- A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system. CVE record
- CVE-2018-6015, 26 Jan 2018
- An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscriber data. CVE record
What to do if you run Email Subscribers & Newsletters
If you run Email Subscribers & Newsletters, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Email Subscribers & Newsletters vulnerabilities
Free. We email you when a new vulnerability is published for Email Subscribers & Newsletters, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.