CVE-2026-12757: CWE-94 Improper Control of Generation of Code ('Code Injection') in icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
Description
The Email Subscribers & Newsletters plugin for WordPress versions up to and including 5.9.27 contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before passing it to the do_shortcode function, leading to improper control of code generation (CWE-94). The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVSS v3.1
Score 6.5medium
Affected software
icegram
Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12757 is a code injection vulnerability in the Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress. The flaw exists in all versions up to 5.9.27 due to improper validation of user-supplied input before executing the do_shortcode function. This allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to unauthorized actions within the WordPress environment.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes within the WordPress site using the affected plugin. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N). There is no indication of availability impact or known active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider restricting access to the plugin's functionality or disabling it if possible to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-19T20:15:20.756Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9ebe31acd9273b49b4b758
Added to database: 09/07/2026, 13:37:53 UTC
Last enriched: 09/15/2026, 01:13:11 UTC
Last updated: 10/23/2026, 01:15:21 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.