Email Subscribers < 5.7.45 - Admin+ Stored XSS

Vulnerability

The Email Subscribers by Icegram Express plugin for WordPress, versions before 5.7.45, fails to sanitize and escape some of its Workflow settings. This allows high privilege users (admin) to inject arbitrary scripts, leading to stored cross-site scripting (XSS). The vulnerability is present even when the unfiltered_html capability is disallowed, such as in multisite setups [1].

Exploitation

An attacker with admin-level access can inject malicious JavaScript into the Workflow settings. The injected script is stored and executed when other users view the affected settings. No additional user interaction is required beyond viewing the page. The attack is feasible even in environments where unfiltered_html is restricted [1].

Impact

Successful exploitation results in stored XSS, allowing the attacker to execute arbitrary JavaScript in the context of other users' browsers. This can lead to session hijacking, defacement, or further compromise of the WordPress site. The attacker gains the ability to perform actions as the victim user [1].

Mitigation

The vulnerability is fixed in version 5.7.45 of the plugin. Users should update to this version or later. No workarounds have been disclosed. The plugin is actively maintained [1].