Vulnerabilities

TI-2026-65981 CVE-2026-96566 · GHSA-5p9m-8jqc-cp3g

Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter

LOW 31

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00271 Published 2026-10-02 No fix listed CWE-79

TI-2026-62415 CVE-2026-92537 · GHSA-r57r-xx5c-pcg3

Insufficiently protected credentials in satollo Newsletter – Send awesome emails from…

LOW 30

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route `/t…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00322 Published 2026-10-01 No fix listed CWE-522

TI-2026-61829 CVE-2026-90981 · GHSA-wfxw-m2wq-7ph8

Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter

LOW 27

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input saniti…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0038 Published 2026-09-18 No fix listed CWE-79

TI-2026-00786 CVE-2026-1051 · GHSA-2wh9-wm58-w79r

Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription

LOW 19

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1.0.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00124 Published 2026-01-20 No fix listed CWE-352

TI-2024-12920 CVE-2024-13900 · GHSA-xh29-r392-48pf

Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments

LOW 32

The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00415 Published 2025-02-21 No fix listed CWE-94

TI-2024-04939 CVE-2024-5317 · GHSA-mjwc-4vr5-7xr3

Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1

LOW 28

The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00291 Published 2024-06-05 No fix listed CWE-79

TI-2023-04399 CVE-2023-4772 · GHSA-67hg-5992-87wq

Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LOW 29

The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletter_form' shortcode in versions up to, and including, 7.8.9 due to insufficient input sanitization and output escaping on u…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00508 Published 2023-09-07 No fix listed CWE-79

TI-2021-06784 CVE-2021-24497 · GHSA-356m-64j5-84f5

Giveaway <= 1.2.2 - Authenticated SQL Injection

LOW 34

The Giveaway WordPress plugin through 1.2.2 is vulnerable to an SQL Injection issue which allows an administrative user to execute arbitrary SQL commands via the $post_id on the options.php page.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01344 Published 2021-08-23 No fix listed CWE-89

Vulnerabilities

Filters