Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Subscribe2 Project Clear all filters
TI-2023-01731 CVE-2023-1844 · GHSA-4r5p-fqj4-2g76

Subscribe2 <= 10.40 - Missing Authorization

Priority LOW 21

The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and including, 10.40.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00503 Published 2023-06-28 No fix listed CWE-862
TI-2023-03185 CVE-2023-3407 · GHSA-hqh4-g6jw-rw6c

Subscribe2 <= 10.40 - Cross-Site Request Forgery

Priority LOW 20

The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00296 Published 2023-06-28 No fix listed CWE-352
TI-2022-03947 CVE-2022-4309 · GHSA-28v3-9vqx-2v5f

Subscribe2 < 10.38 - User Deletion via CSRF

Priority MEDIUM 48

The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.0024 Published 2023-01-16 Fixed in 10.38