Vulnerabilities

TI-2026-81391 CVE-2026-116863 · GHSA-r394-jh8x-rp4v

Cross-site request forgery in WordPress Newsletters plugin

MEDIUM 42

Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00177 Published 2026-10-27 No fix listed CWE-352

TI-2026-80046 CVE-2026-94075 · GHSA-rfh9-4r53-w9wc

PHP object injection in WordPress Newsletters plugin

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00449 Published 2026-10-24 No fix listed CWE-502

TI-2026-80049 CVE-2026-111402 · GHSA-6623-56rc-mrm6

SQL injection in WordPress Newsletters plugin

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00349 Published 2026-10-24 No fix listed CWE-89

TI-2026-47290 CVE-2026-66619 · GHSA-8qv8-7m3w-7633

WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability

LOW 33

Administrator SQL Injection in Newsletters <= 4.18 versions.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00383 Published 2026-09-17 No fix listed CWE-89

TI-2026-41331 CVE-2026-57394 · GHSA-pw92-px5f-34j7

WordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-13 No fix listed CWE-79

TI-2026-41470 CVE-2026-57645 · GHSA-v2jx-863w-h6g6

WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability

LOW 35

newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00346 Published 2026-06-26 No fix listed CWE-862

TI-2026-39643 CVE-2026-54840 · GHSA-7hhw-r4mw-8jm8

WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability

LOW 38

Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00301 Published 2026-06-26 No fix listed CWE-862

TI-2025-41520 CVE-2025-67911 · GHSA-24wx-m9jq-x9f7

WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00456 Published 2026-01-08 No fix listed CWE-502

TI-2025-42475 CVE-2025-69020 · GHSA-ff66-qf7h-2cxr

WordPress Newsletters plugin <= 4.12 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <=…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00159 Published 2025-12-30 No fix listed CWE-79

TI-2025-33879 CVE-2025-54034 · GHSA-2jpf-9j3v-g4h8

WordPress Newsletters plugin <= 4.10 - Local File Inclusion vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Tribulant Software Newsletters newsletters-lite allows PHP Local File Inclusion.This issue affects…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00567 Published 2025-08-20 No fix listed CWE-98

TI-2025-33880 CVE-2025-54035 · GHSA-98cv-3gg8-j2jf

WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through <= 4.10.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00145 Published 2025-07-16 No fix listed CWE-352

TI-2025-22128 CVE-2025-30858 · GHSA-ff9w-348w-x69c

WordPress Snow Storm plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected XSS.This issue affects Snow Storm: from n/a through <= 1.4.6…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00299 Published 2025-04-03 No fix listed CWE-79

TI-2025-22191 CVE-2025-30921 · GHSA-734p-q4p5-pqxr

WordPress Newsletters plugin <= 4.9.9.7 - SQL Injection vulnerability

LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00534 Published 2025-03-27 No fix listed CWE-89

TI-2025-19802 CVE-2025-26931 · GHSA-fh22-j9rm-v87g

WordPress Tribulant Gallery Voting plugin <= 1.2.1 - CSRF to Stored XSS vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Tribulant Gallery Voting gallery-voting allows Stored XSS.This issue affects Tribulant Gallery Voting: from n/a through <= 1.2.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00146 Published 2025-02-25 No fix listed CWE-352

TI-2025-18316 CVE-2025-24599 · GHSA-42qh-h645-hm57

WordPress Newsletters plugin <= 4.9.9.6 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00255 Published 2025-02-04 No fix listed CWE-79

TI-2024-31664 CVE-2024-47346 · GHSA-qh2c-49jf-6c8g

WordPress Newsletters plugin <= 4.9.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0032 Published 2024-10-06 No fix listed CWE-79

TI-2024-31694 CVE-2024-47376 · GHSA-wfrf-3677-pf84

WordPress Slideshow Gallery LITE plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Slideshow Gallery slideshow-gallery allows Cross-Site Scripting (XSS).This issue affects Slideshow…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00275 Published 2024-10-05 No fix listed CWE-79

Vulnerabilities

Filters