CVE-2021-24556

The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted subscribe_email and subscribe_name POST parameters, inserting them in the DB and then outputting them back in the Subscriber list (/wp-admin/edit.php?post_type=kes_campaign&page=kento_email_subscriber_list_settings), leading a Stored XSS issue.

• CWE-79
• CWE-79

• https://codevigilant.com/disclosure/2021/wp-plugin-email-subscriber/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/f050aedc-f79f-4b27-acac-0cdb33b25af8Exploit, Third Party Advisory
• https://codevigilant.com/disclosure/2021/wp-plugin-email-subscriber/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/f050aedc-f79f-4b27-acac-0cdb33b25af8Exploit, Third Party Advisory

Published

Aug 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24550The Broken Link Manager WordPress plugin through 0.6.5 does …7.2
• CVE-2021-24551The Edit Comments WordPress plugin through 0.3 does not sani…9.8
• CVE-2021-24552The Simple Events Calendar WordPress plugin through 1.4.0 do…7.2
• CVE-2021-24553The Timeline Calendar WordPress plugin through 1.2 does not …7.2
• CVE-2021-24554The Paytm – Donation Plugin WordPress plugin through 1.3.2 d…7.2
• CVE-2021-24555The daac_delete_booking_callback function, hooked to the daa…8.8
• CVE-2021-24557The update functionality in the rslider_page uses an rs_id P…7.2
• CVE-2021-24558The pspin_duplicate_post_save_as_new_post function of the Pr…5.4
• CVE-2021-24559The Qyrr WordPress plugin before 0.7 does not escape the dat…5.4
• CVE-2021-2456Vulnerability in the Oracle Business Intelligence Enterprise…9.8
• CVE-2021-24560The Software License Manager WordPress plugin before 4.4.8 d…6.1
• CVE-2021-24561The WP SMS WordPress plugin before 5.4.13 does not sanitise …5.4