High severity · published Feb 19, 2025
CVE-2024-11582
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter
7.2
CVSS
0.3%
EPSS
No
On KEV
Description
The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ip parameter in all versions up to, and including, 10.43 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Subscribe2 – Form, Email Subscribers & Newsletters · wedevs
through 10.43 · source: vendor
Affected product
SF
Subscribe2 – Form, Email Subscribers & Newsletters
wedevs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11582
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11582
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/subscribe2/tags/10.43/classes/class-s2-list-table.php#L72
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/36777e39-be45-41f2-beca-2971e15b77cd?source=cve