Read the docs

Subscribe2 Project

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Subscribe2 Project records in CISA KEV

No Subscribe2 Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Subscribe2 4 records MEDIUM

Records

4 records in Subscribe2 · all components

TI-2022-03947 CVE-2022-4309 · GHSA-28v3-9vqx-2v5f

Subscribe2 < 10.38 - User Deletion via CSRF

Priority MEDIUM 48

The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.0024 Published 2023-01-16 Fixed in 10.38
TI-2023-01731 CVE-2023-1844 · GHSA-4r5p-fqj4-2g76

Subscribe2 <= 10.40 - Missing Authorization

Priority LOW 21

The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and including, 10.40.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00503 Published 2023-06-28 No fix listed CWE-862
TI-2023-03185 CVE-2023-3407 · GHSA-hqh4-g6jw-rw6c

Subscribe2 <= 10.40 - Cross-Site Request Forgery

Priority LOW 20

The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00296 Published 2023-06-28 No fix listed CWE-352
Open these records in search →