Newsletters (Unknown) - vulnerabilities (CVEs)
11 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-23. Vendor: Unknown.
CVEs of Newsletters
- CVE-2026-16264 - CVSS 6.5 (medium), 2026-09-23: The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management…
- CVE-2026-81741 - CVSS 4.7 (medium), 2026-09-09: The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference…
- CVE-2026-81660 - CVSS 8.8 (high), 2026-08-30: The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web…
- CVE-2026-17522 - CVSS 5.4 (medium), 2026-08-29: The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every…
- CVE-2026-17520 - CVSS 4.8 (medium), 2026-08-29: The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value,…
- CVE-2026-16269 - CVSS 4.8 (medium), 2026-08-08: The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API…
- CVE-2026-16267 - CVSS 8.1 (high), 2026-08-08: The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing…
- CVE-2026-16268 - CVSS 8.2 (high), 2026-08-06: The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server…
- CVE-2026-12583 - CVSS 8.1 (high), 2026-07-14: The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing…
- CVE-2026-8089 - CVSS 7.1 (high), 2026-06-17: The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape…
- CVE-2023-4797 - CVSS 7.2 (high), 2024-01-16: The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands,…
