CVE-2021-24874

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

CVE-2021-25033

The CVE-2021-25033 entry corresponds to a vulnerability in the WordPress Newsletter/Noptin plugin. Affected software: Noptin

CVE-2021-25033 Noptin < 1.6.5 - Open Redirect

The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue...

WordPress 输入验证错误漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. An input validation error vulnerability exists in WordPress Plugin Newsletter, which stems from a WordPress...

WordPress Sendit WP Newsletter plugin <= 2.5.1 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Shreya Pohekar in WordPress Sendit WP Newsletter plugin versions = 2.5.1. Solution This plugin has been closed as of April 29, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Newsletter plugin unsafe deserialization vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. An insecure deserialization vulnerability exists in the Newsletter plugin in WordPress versions prior to 6.8.2. An authenticated remote attacker can exploit this vulnerability to inject arbitrar...

WordPress Newsletter plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability in WordPress Newsletter plugin versions prior to 6.8.2 allows...

CVE-2020-35932

Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...

CVE-2020-35932

Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...

CVE-2020-35933

A Reflected Authenticated Cross-Site Scripting XSS vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpcrender AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing...

Cross site scripting

A Reflected Authenticated Cross-Site Scripting XSS vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpcrender AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing...

Deserialization of untrusted data

Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges such as subscribers to use the tpncrender AJAX action to inject arbitrary PHP objects via the optionsinlineedits parameter. NOTE: exploitability depends on PH...

CVE-2020-35933

CVE-2020-35933 affects the WordPress Newsletter plugin prior to 6.8.2. A reflected, authenticated XSS can be triggered by submitting a tnpc_render AJAX request containing JavaScript in the options parameter or a base64-encoded JSON string with JavaScript in encoded_options. Impact is limited to t...

CVE-2020-35933

A Reflected Authenticated Cross-Site Scripting XSS vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpcrender AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing...

CVE-2020-35932

The CVE concerns the WordPress Newsletter plugin prior to version 6.8.2, where an insecure deserialization flaw exists in the tpnc_render AJAX path. An authenticated user with minimal privileges (e.g., a subscriber) can submit options[inline_edits] data to wp-admin/admin-ajax.php, leading to unse...

PT-2021-11867 · WordPress · Newsletters

Name of the Vulnerable Software and Affected Versions: Newsletter plugin versions prior to 6.8.2 for WordPress Description: A Reflected Authenticated Cross-Site Scripting XSS issue allows remote attackers to trick a victim into submitting a tnpc render AJAX request. This request can contain eithe...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability in WordPress Newsletter plugin versions prior to 6.8.2 allows...

WordPress Newsletter Plugin Reflected Cross Site Scripting

A reflected cross site scripting vulnerability exists in WordPress Newsletter Plugin. Successful exploitation of this vulnerability could allow attackers to execute arbitrary code on the affected system...

Newsletter Plugin for WordPress < 6.8.2 Multiple Vulnerabilities

The WordPress Newsletter Plugin installed on the remote host is affected by an authenticated reflected Cross-Site Scripting XSS and a PHP object injection vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

WordPress Newsletter Plugin < 6.8.2 Multiple Vulnerabilities

The WordPress plugin Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...