Email Subscribers & Newsletters vulnerabilities

The Email Subscribers & Newsletters plugin for WordPress before version 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.

The Email Subscribers & Newsletters plugin for WordPress up to version 5.9.27 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes.

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters versions up to 5.9.33.

The Email Subscribers & Newsletters plugin for WordPress up to version 5.9.27 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access or higher can overwrite mail settings, create audience lists, insert contacts, create and overwrite newsletters, add workflows, and send mass emails to arbitrary recipients.