Email Subscribers & Newsletters vulnerabilities

The Email Subscribers & Newsletters plugin for WordPress up to version 5.9.27 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes.

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters versions up to 5.9.33.

The Email Subscribers & Newsletters plugin for WordPress up to version 5.9.27 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access or higher can overwrite mail settings, create audience lists, insert contacts, create and overwrite newsletters, add workflows, and send mass emails to arbitrary recipients.