CVE-2025-10683

MediumCVSS 4.9

Published: 06/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

20th percentile - higher than 20% of all known CVEs

Summary

The Easy Email Subscription plugin for WordPress (all versions up to and including 1.3) is vulnerable to SQL Injection via the 'uid' parameter due to insufficient escaping and lack of preparation on the existing SQL query. An authenticated attacker with Administrator-level access and above can append additional SQL queries to extract sensitive information from the database.

Risk Assessment

An attacker with administrator privileges can exfiltrate sensitive data from the WordPress database, including subscriber data and other sensitive information.

Recommendation

Update the Easy Email Subscription plugin to a version newer than 1.3. Limit the number of administrator accounts and regularly review database logs.

Other vulnerabilities in Easy Email Subscription

CVE-2025-10691Medium
The WordPress plugin Easy Email Subscription in all versions up to and including 1.3 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the show_editsub_page() function. This allows unauthenticated attackers to delete arbitrary subscribers via a forged request if they can trick an administrator into clicking a link.

Original NVD description (English source)

The Easy Email Subscription plugin for WordPress is vulnerable to SQL Injection via the 'uid' parameter in all versions up to, and including, 1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS