CVE-2019-14364

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters plugin version 4.1.6

Description The issue allows an attacker to inject malicious JavaScript code through a publicly available subscription form. This is achieved by exploiting the esfpx name parameter in the "wp-admin/admin-ajax.php" API endpoint.

Recommendations For Email Subscribers & Newsletters plugin version 4.1.6, consider disabling the subscription form until a patch is available to prevent exploitation. Restrict access to the "wp-admin/admin-ajax.php" API endpoint to minimize the risk of malicious code injection. Avoid using the esfpx name parameter in the affected API endpoint until the issue is resolved.