CVE-2024-2656 in Icegram Express Plugin
Summary
by MITRE • 04/06/2024
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a CSV import in all versions up to, and including, 5.7.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/14/2026
The vulnerability identified as CVE-2024-2656 affects the Email Subscribers plugin for WordPress, specifically versions up to and including 5.7.14. This plugin serves as an email marketing solution that integrates with WordPress and WooCommerce environments, making it a critical component in many digital marketing infrastructures. The flaw manifests as a stored cross-site scripting vulnerability that occurs during CSV import operations, representing a significant security risk for WordPress installations that rely on this plugin for newsletter management and customer communication.
The technical root cause of this vulnerability lies in insufficient input sanitization and output escaping mechanisms within the plugin's CSV import functionality. When administrators or authorized users upload CSV files containing malicious script content, the plugin fails to properly sanitize the input data before storing it in the database. This stored malicious content then executes whenever users access pages that contain the injected scripts, creating a persistent threat vector that can affect multiple users within the WordPress environment. The vulnerability specifically impacts multi-site installations where the unfiltered_html capability has been disabled, indicating that the protection mechanisms that would normally prevent such attacks are either absent or insufficient in these configurations.
The operational impact of this vulnerability is severe for affected WordPress installations, particularly those with administrative users who regularly handle CSV imports for email campaigns. Attackers with administrator-level permissions can leverage this vulnerability to execute arbitrary web scripts in the context of the victim's browser, potentially leading to session hijacking, data exfiltration, or further privilege escalation within the WordPress environment. The stored nature of the vulnerability means that once malicious content is injected, it remains persistent and will execute automatically whenever affected pages are accessed, creating a continuous threat that can affect multiple users over time. This vulnerability is particularly concerning in multi-site environments where administrators may have varying levels of trust and where the attack surface is already expanded.
Organizations affected by this vulnerability should immediately update to the latest version of the Email Subscribers plugin where the issue has been patched, as the vulnerability specifically affects versions up to and including 5.7.14. Administrators should also implement additional security measures such as restricting CSV import capabilities to only trusted users and monitoring import activities for suspicious content. The vulnerability aligns with CWE-79 which represents Cross-site Scripting flaws, and maps to ATT&CK technique T1546.001 which involves modifying or adding startup items to gain persistence. Organizations should also consider implementing web application firewalls and content security policies to mitigate the impact of similar vulnerabilities in other plugins and themes that may be present in their WordPress environments.