Vulnerabilities

TI-2026-63943 CVE-2026-97074 · GHSA-px7h-jc96-f274

Authorization bypass in Omnisend Newsletters, Email Marketing, SMS and Popups by Omnisend

LOW 20

Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00246 Published 2026-09-30 No fix listed CWE-639

TI-2026-41458 CVE-2026-57632 · GHSA-qqcv-c52c-7244

WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerability

LOW 24

Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00287 Published 2026-06-26 No fix listed CWE-862

TI-2026-30927 CVE-2026-42668 · GHSA-7j8h-2p3w-mmhx

WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability

LOW 39

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00427 Published 2026-06-15 No fix listed CWE-288

TI-2024-21178 CVE-2024-32101 · GHSA-cf34-9vfw-jmhg

WordPress Email Marketing for WooCommerce plugin <= 1.14.3 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend omnisend-connect.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through <= 1.14.3.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00214 Published 2024-04-15 No fix listed CWE-352

TI-2023-25562 CVE-2023-47244 · GHSA-48xv-7x9m-w99q

WordPress Email Marketing for WooCommerce by Omnisend Plugin <= 1.13.8 is vulnerable to Sensitive Data Exposure

LOW 34

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00553 Published 2023-11-23 No fix listed CWE-200