CVE-2025-11994

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11994", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-20T20:11:11.925Z", "datePublished": "2025-11-12T11:05:39.391Z", "dateUpdated": "2026-04-08T17:17:16.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:16.000Z"}, "affected": [{"vendor": "yudiz", "product": "Easy Email Subscription", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b5bb14c1-8713-4aa1-b50a-53bed07a5f80?source=cve"}, {"url": "https://plugins.svn.wordpress.org/email-subscription-with-secure-captcha/tags/1.3/subscriber-form.php"}, {"url": "https://plugins.svn.wordpress.org/email-subscription-with-secure-captcha/tags/1.3/simple-email-subscription.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3388578%40email-subscription-with-secure-captcha&new=3388578%40email-subscription-with-secure-captcha&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-10-20T20:26:20.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-11T21:45:38.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T14:14:38.331623Z", "id": "CVE-2025-11994", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T14:14:55.262Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11994", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T14:14:38.331623Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T14:14:46.397Z"}}], "cna": {"title": "Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "yudiz", "product": "Easy Email Subscription", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-20T20:26:20.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-11T21:45:38.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b5bb14c1-8713-4aa1-b50a-53bed07a5f80?source=cve"}, {"url": "https://plugins.svn.wordpress.org/email-subscription-with-secure-captcha/tags/1.3/subscriber-form.php"}, {"url": "https://plugins.svn.wordpress.org/email-subscription-with-secure-captcha/tags/1.3/simple-email-subscription.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3388578%40email-subscription-with-secure-captcha&new=3388578%40email-subscription-with-secure-captcha&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-12T11:05:39.391Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11994", "state": "PUBLISHED", "dateUpdated": "2025-11-12T14:14:55.262Z", "dateReserved": "2025-10-20T20:11:11.925Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-12T11:05:39.391Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Easy Email Subscription", "vendor": "yudiz", "versions": [{"lessThanOrEqual": "1.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Easy Email Subscription para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'name' en todas las versiones hasta la 1.3, inclusive, debido a la sanitizaci\u00f3n insuficiente de la entrada y el escape de la salida. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-11994", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11994", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T14:14:38.331623Z", "version": "2.0.3"}}]}, "published": "2025-11-12T11:15:40.180", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/email-subscription-with-secure-captcha/tags/1.3/simple-email-subscription.php"}, {"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/email-subscription-with-secure-captcha/tags/1.3/subscriber-form.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3388578%40email-subscription-with-secure-captcha&new=3388578%40email-subscription-with-secure-captcha&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b5bb14c1-8713-4aa1-b50a-53bed07a5f80?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:39:27.398114+00:00", "value": {"mitigation_remediation": ["Upgrade the Easy Email Subscription plugin to the latest version that includes the XSS fix.", "If an upgrade is not immediately possible, remove or disable the 'name' input field in the subscriber form to prevent new malicious data from being stored.", "Apply server\u2011side input validation and output escaping to the 'name' field using WordPress functions such as esc_html() to neutralize future attempts of script injection.", "Configure a Content Security Policy that disallows inline scripts to mitigate the impact of any stored scripts that might have already been injected."], "summary": {"action": "Patch Immediately", "impact": "Stored XSS"}, "threat_synthesis": {"affected_systems": "All builds of the Easy Email Subscription plugin, from its initial release through version 1.3, are vulnerable. The plugin is released by the WordPress community under the vendor yudiz and is available as a WordPress plugin. Any WordPress site using this plugin in a version up to and including 1.3 is affected, while newer releases are not known to contain the flaw.", "description_and_impact": "The Easy Email Subscription plugin for WordPress stores user-supplied data in the 'name' field without sanitizing or escaping it, creating a stored cross\u2011site scripting weakness. An unauthenticated attacker can submit arbitrary JavaScript via that field, which will run in any visitor\u2019s browser when the stored data is displayed. This classic input validation flaw (CWE\u201179) can be leveraged to hijack sessions, deface content, or launch phishing attacks and therefore strongly impacts confidentiality and integrity of site users.", "risk_and_exploitability": "The CVSS v3.1 score of 7.2 indicates a high potential impact on site visitors, yet the EPSS score of less than 1% reflects a low current likelihood of exploitation in the wild. Because the vulnerability is triggered via an unauthenticated public web interface, any publicly accessible WordPress installation that hosts the affected plugin can be targeted. Although it is not yet listed in the CISA KEV catalog, the severity of the stored XSS warrants prompt remediation."}}}}, "created": "2025-11-12T22:12:44.609172+00:00", "updated": "2026-04-21T01:45:24.442319+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "yudiz", "yudiz$PRODUCT$easy_email_subscription"]}