PT-2025-34997

Name of the Vulnerable Software and Affected Versions: nonletter Newsletter subscription optin module versions through 1.2.9 Description: A Cross-Site Request Forgery CSRF vulnerability exists in the Newsletter subscription optin module, which also allows for Stored Cross-Site Scripting XSS...

WordPress plugin newsletter subscription optin module cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...

WordPress Newsletter subscription optin module plugin <= 1.2.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Newsletter subscription optin module versions = 1.2.9...

MAL-2025-26200 Malicious code in merchant-newsletter-widget (npm)

The package merchant-newsletter-widget was found to contain malicious code...

Malicious code in merchant-newsletter-widget (npm)

The package merchant-newsletter-widget was found to contain malicious code...

A message from Bruce the mechanical shark

Welcome to this week's edition of the Threat Source newsletter. Hi, I'm Bruce, the 25-foot mechanical star of "Jaws." This summer marks 50 years since my 4 minutes of screentime kept people out of the water for decades. Maybe this Fourth of July weekend you're planning to sea-shanty your way to a...

A Bootiful Podcast: Dr. Heinz Kabutz, a legendary Java Champion, teacher, and author of the Java Specialists newsletter!

Hi, Spring fans! In this installment, I talk to Dr. Heinz Kabutz, a legendary Java Champion, trainer, teacher, and author of the Java Specialists newsletter! This episode was recorded live at Devoxx UK 2025...

CVE-2025-3582

The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Newsletter plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. WordPress Newsletter plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data,...

WordPress Newsletter plugin < 8.8.5 - Admin+ Stored XSS via Widget vulnerability

Admin+ Stored XSS via Widget vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin NewsLetter versions 8.8.5...

CVE-2025-3581

The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtm...

CVE-2025-3582

The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-3581

CVE-2025-3581 affects the Newsletter WordPress plugin (versions prior to 8.8.5). The issue is a failure to validate/escape certain Widget options before output, enabling a stored XSS when the block is embedded on a page/post, potentially exploitable by high-privilege users such as admins, includi...

WordPress plugin Newsletter security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2025-24402 · WordPress · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.8.5 Description: The issue concerns a lack of validation and escaping of certain Widget options in the plugin, which can lead to Stored Cross-Site Scripting attacks. This can be exploited by...

PT-2025-24403 · WordPress · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.85 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and esca...

WordPress plugin Newsletter security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2025-3584

The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-3584

The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-3584 Newsletter < 8.8.2 - Admin+ Stored XSS via Subscription

The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...