{"id":"CVE-2024-11636","aliases":["EUVD-2024-34204","GHSA-hpcp-qr34-rj6h"],"status":"published","title":"Email Subscribers \u003c 5.7.45 - Admin+ Stored XSS","description":"The Email Subscribers by Icegram Express  WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00332,"percentile":0.26785,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-79"],"published":"2025-01-13T06:00:00Z","modified":"2026-06-17T06:58:07Z","products":[{"vendor":"icegram","product":"email_subscribers_\\\u0026_newsletters"},{"vendor":"unknown","product":"email subscribers by icegram express"}],"references":[{"url":"https://wpscan.com/vulnerability/da616c20-3d74-4d3a-95f5-2d71d9ada094/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11636"},{"url":"https://wpscan.com/vulnerability/da616c20-3d74-4d3a-95f5-2d71d9ada094"},{"url":"https://github.com/advisories/GHSA-hpcp-qr34-rj6h"}],"sources":{"cve":[{"id":"CVE-2024-11636","title":"Email Subscribers \u003c 5.7.45 - Admin+ Stored XSS","description":"The Email Subscribers by Icegram Express  WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","status":"published","published":"2025-01-13T06:00:00.902Z","modified":"2025-01-13T14:56:40.111Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:19.965827Z"}],"euvd":[{"id":"EUVD-2024-34204","description":"The Email Subscribers by Icegram Express  WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","status":"published","published":"2025-01-13T06:00:00Z","modified":"2025-01-13T14:56:40Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:21.239531Z"}],"ghsa":[{"id":"GHSA-hpcp-qr34-rj6h","title":"The Email Subscribers by Icegram Express  WordPress plugin before 5.7.45 does not sanitise and...","description":"The Email Subscribers by Icegram Express  WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","status":"published","published":"2025-01-13T06:30:25Z","modified":"2025-05-08T21:32:51Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:02:12.439359Z"}],"nvd":[{"id":"CVE-2024-11636","description":"The Email Subscribers by Icegram Express  WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","status":"published","published":"2025-01-13T06:15:08.693Z","modified":"2026-06-17T06:58:07.36Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-20","CWE-79"],"updated_at":"2026-11-02T14:10:42.329342Z"}]}}