Input validation vulnerability in Icegram Express – Email Subscribers, Newsletters and Marketing Automation Plugin 2.9.1

The Email Subscribers & Newsletters plugin for WordPress can be vulnerable to Cross-Site Scripting, which occurs when attackers inject malicious web scripts into a victim’s browser. This is a security issue that affects versions of the plugin before 2.9.1, and is caused by insufficient sanitization and output escaping of certain parameters such as ‘search’, ‘es_mail_group’, ‘sts’, ‘cnt’, and ‘pagemail’ in some of the plugin’s files (sendmail.php, view-subscriber-show.php, and sentmail-preview.php respectively). To keep your website safe, make sure you update your plugin to version 2.9.1 or later.