The Email Subscribers by Icegram Express WordPress plugin is vulnerable to stored XSS via CSV import due to improper input sanitization and output escaping. Authenticated administrators can inject malicious scripts that execute when users access affected pages. This vulnerability affects multi-site installations or those with unfiltered_html disabled, in all versions up to 5.7.14. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level access can inject arbitrary web scripts into pages via CSV import. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability only affects specific WordPress configurations (multi-site or unfiltered_html disabled). There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and avoid importing CSV files from untrusted sources. Monitor for updates from Icegram regarding patches or official mitigations.