Newsletter (Unknown) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-17. Vendor: Unknown.
CVEs of Newsletter
- CVE-2026-86824 - CVSS 4.8 (medium), 2026-09-17: The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an…
- CVE-2026-86823 - CVSS 5.3 (medium), 2026-09-16: The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing…
- CVE-2025-3581 - CVSS 4.8 (medium), 2025-06-09: The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the…
- CVE-2025-3582 - CVSS 4.8 (medium), 2025-06-09: The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to…
- CVE-2025-3584 - CVSS 4.8 (medium), 2025-06-03: The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as…
- CVE-2025-3583 - CVSS 4.8 (medium), 2025-05-05: The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
- CVE-2024-9186 - CVSS 8.6 (high), 2024-11-14: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and…
- CVE-2023-2472 - CVSS 6.1 (medium), 2023-06-05: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before…
- CVE-2021-24874 - CVSS 6.1 (medium), 2022-02-14: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before…
- CVE-2021-24923 - CVSS 6.1 (medium), 2022-01-24: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter…
