CVE-2025-10691

MediumCVSS 4.3

Published: 06/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

The WordPress plugin Easy Email Subscription in all versions up to and including 1.3 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the show_editsub_page() function. This allows unauthenticated attackers to delete arbitrary subscribers via a forged request if they can trick an administrator into clicking a link.

Risk Assessment

An attacker could delete subscribers without their consent, leading to data loss and communication disruption. This may harm reputation and customer relationships.

Recommendation

Update the Easy Email Subscription plugin to a version newer than 1.3 as soon as it becomes available. Until then, consider disabling the plugin and educate administrators about clicking unknown links.

Other vulnerabilities in Easy Email Subscription

CVE-2025-10683Medium
The Easy Email Subscription plugin for WordPress (all versions up to and including 1.3) is vulnerable to SQL Injection via the 'uid' parameter due to insufficient escaping and lack of preparation on the existing SQL query. An authenticated attacker with Administrator-level access and above can append additional SQL queries to extract sensitive information from the database.

Original NVD description (English source)

The Easy Email Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the show_editsub_page() function. This makes it possible for unauthenticated attackers to delete arbitrary subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS