plugin

Ultimate Subscribe Vulnerabilities

2 known security issues reported for the Ultimate Subscribe WordPress plugin. Most recent disclosed Jan 22, 2025.

1 medium

Running Ultimate Subscribe on your site? Check whether your installed version is affected.

Ultimate Subscribe [ultimate-subscribe] <= 1.3 (unfixed + closed)

unknown

[en] Cross-Site Request Forgery (CSRF) vulnerability in ThemeFarmer Ultimate Subscribe allows Reflected XSS. This issue affects Ultimate Subscribe: from n/a through 1.3.

Affected:: up to 1.3
Fix:: No patched version reported
Disclosed:: Jan 22, 2025

CVE-2025-23806 on NVD →

Ultimate Subscribe <= 1.3 - Reflected Cross-Site Scripting

medium

The Ultimate Subscribe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can success...

CVSS:: 6.1
Affected:: up to 1.3
Fix:: No patched version reported
Disclosed:: Jan 16, 2025

CVE-2025-23806 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database