CVE-2025-24587
HIGHI Thirteen Web Solution Email Subscription Popup <1.2.23 - SQL Inje...
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-24587. PoCs published by DoTTak.
AI-analyzed exploit summary This PoC demonstrates an SQL injection vulnerability in the WordPress 'Email Subscription Popup' plugin (version <= 1.2.23). The exploit involves subscribing a malicious email address containing an SQL payload, which executes when an administrator deletes the subscriber, resulting in the deletion of all subscriptions.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.
Exploits (1)
This PoC demonstrates an SQL injection vulnerability in the WordPress 'Email Subscription Popup' plugin (version <= 1.2.23). The exploit involves subscribing a malicious email address containing an SQL payload, which executes when an administrator deletes the subscriber, resulting in the deletion of all subscriptions.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L