Read the docs

MailerLite

Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

MailerLite records in CISA KEV

No MailerLite vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mailerlite Signup Forms 2 records LOW Mailerlite 1 record LOW

Records

11 records

TI-2025-41554 CVE-2025-67945 · GHSA-q8c3-r22r-mrwf

WordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability

Priority MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite – Wo…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00442 Published 2026-01-22 No fix listed CWE-89
TI-2024-02608 CVE-2024-2797 · GHSA-rh3p-jx4j-wj9v

MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization

Priority LOW 31

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized plugin setting changes due to a missing capability check on the toggleRolesAndPermissions and editAllowedRolesAndPermissions fun…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00504 Published 2024-05-02 No fix listed CWE-862
TI-2024-01293 CVE-2024-1386 · GHSA-gmr5-x2m6-c7h5

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored…

Priority LOW 29

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions 1.5.0 to 1.7.6 due to insufficient input sanitization and output escapi…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0042 Published 2024-05-02 No fix listed
TI-2022-01474 CVE-2022-1604 · GHSA-j7x8-rcv8-xg5g

MailerLite < 1.5.4 - Reflected Cross-Site Scripting

Priority LOW 29

The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00862 Published 2022-06-13 Fixed in 1.5.4 CWE-79
TI-2025-12787 CVE-2025-13993 · GHSA-647v-r7p3-c33c

MailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting

Priority LOW 25

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_description' and 'success_message' parameters in versions up to, and including, 1.7.16 due to insuf…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00343 Published 2025-12-12 No fix listed CWE-79
TI-2026-20537 CVE-2026-25420 · GHSA-6vfc-pv6m-f4jg

WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability

Priority LOW 20

Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00279 Published 2026-02-19 No fix listed CWE-862
TI-2026-02808 CVE-2026-3253 · GHSA-h68w-8j2h-7hvq

Missing authorization in MailerLite – Signup forms

Priority LOW 19

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to,…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00188 Published 2026-09-24 No fix listed CWE-862
Open these records in search →