CVE-2025-11994 is a stored cross-site scripting vulnerability in the Easy Email Subscription plugin for WordPress, affecting all versions up to and including 1.3. The issue stems from improper neutralization of input in the 'name' parameter, enabling unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability can lead to limited confidentiality and integrity impacts without affecting availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to information disclosure and modification of content (confidentiality and integrity impacts). There is no impact on availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Easy Email Subscription plugin or applying custom input sanitization and output escaping as a temporary mitigation.