title: WP Email Users <= 1.7.6 - Subscriber+ SQL Injection
description: The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.
problem types: CWE-89 SQL Injection
affected:
{
product: WP Email Users
vendor: Unknown
versions:
lessThanOrEqual: 1.7.6, status: affected, version: 1.7.6, versionType: custom
}