Stored Cross-Site Scripting Vulnerability in Easy Email Subscription Plugin for WordPress

CVE-2025-11994

What is CVE-2025-11994?

The Easy Email Subscription plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability through the 'name' parameter. This issue arises from inadequate input sanitization and output escaping mechanisms. As a result, attackers without authentication can exploit this flaw to inject malicious web scripts, which will execute whenever users visit affected pages, potentially leading to unauthorized actions and compromised user data.

References