Hello,

Plugin: Email Subscribers 2.9 https://wordpress.org/plugins/email-subscribers/

1. Cross-Site Scripting (XSS) (page=es-sendemail)

Authenticated administrators can inject arbitrary html/javascript code (there is no CSRF protection).

Method: POST/GET

Example url: http://localhost/wp-admin/admin.php?page=es-sendemail&search=[xss]

Vulnerable parameters: search (GET,POST), es_email_group (POST)

Example PHP callstack:

/email-subscribers/sendmail/sendmail.php:240

Verification:

2. Cross-Site Scripting (XSS) (page=es-view-subscribers)

Authenticated administrators can inject arbitrary html/javascript code (there is no CSRF protection).

Method: GET

Example url: http://localhost/wp-admin/admin.php?page=es-view-subscribers&search=[xss]

Vulnerable parameters: search, sts, cnt

Example PHP callstack:

/email-subscribers/subscribers/view-subscriber-show.php:406

Verification:

3. SQL injection (es_view_subscriber_search())

Authenticated administrators can execute arbitrary sql commands (there is no CSRF protection).

Method: POST

Example url: http://localhost/wp-admin/admin.php?page=es-view-subscribers&did=[sqli]&ac=resend

Vulnerable parameter: did (GET)

Example PHP callstack:

/email-subscribers/subscribers/view-subscriber-show.php:75

es_cls_sendmail::es_prepare_optin   [/email-subscribers/classes/es-sendmail.php:15]

es_cls_dbquery::es_view_subscriber_search   [/email-subscribers/query/db_subscriber.php:35]

wpdb::get_results  

Another Example PHP callsttack:

/email-subscribers/subscribers/view-subscriber-edit.php:24

es_cls_dbquery::es_view_subscriber_search   [email-subscribers/query/db_subscriber.php:35]

wpdb::get_results

Verification:

curl --cookie "..." --data "frm_es_display=yes&frm_es_bulkaction=1" "http://localhost/wp-admin/admin.php?page=es-view-subscribers&did=1%20OR%20(SELECT%20*%20FROM%20(SELECT%20SLEEP(5))XXX)%20--%20-&ac=resend"

4. SQL injection (es_notification_select())

Authenticated administrators can execute arbitrary sql commands (there is no CSRF protection). Attacker needs to know valid "did" id to exploit this vulnerability.

Method: GET

Url: http://localhost/wp-admin/admin.php?page=es-notification&ac=edit&did=[sqli]

Vulnerable parameter: did

Example PHP callstack:

email-subscribers/notification/notification-edit.php:19

es_cls_notification::es_notification_select   [email-subscribers/query/db_notification.php:14]

wpdb::get_row

Verification (did=1 is valid):

5. SQL injection (es_template_select()) + XSS

Authenticated administrators can execute arbitrary sql commands (there is no CSRF protection).

Method: GET

Url: http://localhost/wp-admin/admin.php?page=es-compose&ac=preview&did=[sqli]

Vulnerable param: did

Callstack:

/email-subscribers/compose/compose-preview.php:20

es_cls_compose::es_template_select   [/email-subscribers/query/db_compose.php:14]

wpdb::get_row

Verification:

Additionally the same parameter ("did") allows authenticated administrators to inject html/js code resulting in XSS vulnerability.

Callstack:

/email-subscribers/compose/compose-preview.php   [:29]

Verification: 

6.  SQL injection (es_sentmail_select())

Authenticated administrators can execute arbitrary sql commands (there is no CSRF protection).

Method: GET

Url: http://localhost/wp-admin/admin.php?page=es-sentmail&ac=preview&did=[sqli]

Vulnerable param: did

Example PHP callstack:

/email-subscribers/sentmail/sentmail-preview.php:22

es_cls_sentmail::es_sentmail_select [/email-subscribers/query/db_sentmail.php:14]

wpdb::get_row

Verification:

7.  Cross-Site Scripting (XSS) (page=es-sentmail)

Authenticated administrators can inject arbitrary html/javascript code (there is no CSRF protection).

Method: GET

Url: http://localhost/wp-admin/admin.php?page=es-sentmail&ac=preview&pagenum=[xss]

Vulnerable parameter: pagenum

Example PHP callstack:

/email-subscribers/sentmail/sentmail-preview.php:30

Verification: