The Easy Email Subscription plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting, which could allow attackers to execute arbitrary scripts in the context of a user session.

The plugin fails to properly sanitize the name parameter, allowing unauthenticated attackers to inject malicious web scripts that execute when a user accesses an affected page.

This vulnerability poses a significant risk to site integrity and user security. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of administrators, or the redirection of visitors to malicious domains. With a CVSS score of 7.2, the vulnerability is classified as High severity due to its potential for impact on site visitors and administrative sessions.

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate and remove the Easy Email Subscription plugin from their WordPress environments.

Proactive Monitoring: Monitor site access logs for suspicious input patterns in subscriber forms or unusual script execution requests originating from public-facing pages.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common Cross-Site Scripting attack vectors and filter malicious script tags from user-supplied input.

Public Exploit Available: No (exploit_available: false)

Given the lack of a verified patch and the ease of exploitation, the most effective mitigation is the immediate removal of the vulnerable plugin. Organizations relying on this software for subscription management should evaluate alternative plugins that maintain active security maintenance and follow secure coding practices.