Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Newsletters 4.17 Clear all filters
TI-2026-14373 CVE-2026-17522 · GHSA-mx7c-44xm-6gm6

Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

Priority LOW 23

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00138 Published 2026-08-29 Fixed in 4.17 CWE-352
TI-2026-14372 CVE-2026-17520 · GHSA-jf3w-mh76-5398

Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key

Priority LOW 21

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform pr…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00185 Published 2026-08-29 Fixed in 4.17 CWE-326