CVE-2024-33944

Missing Authorization vulnerability in Kestrel WooCommerce AWeber Newsletter Subscription.This issue affects WooCommerce AWeber Newsletter Subscription: from n/a through 4.0.2...

CVE-2024-33944 WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerability

Missing Authorization vulnerability in Kestrel WooCommerce AWeber Newsletter Subscription.This issue affects WooCommerce AWeber Newsletter Subscription: from n/a through 4.0.2...

CVE-2024-33944 WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerability

Missing Authorization vulnerability in Kestrel WooCommerce AWeber Newsletter Subscription.This issue affects WooCommerce AWeber Newsletter Subscription: from n/a through 4.0.2...

CVE-2024-33944

CVE-2024-33944 is a Missing Authorization vulnerability affecting the WooCommerce AWeber Newsletter Subscription plugin for WordPress, with affected range up to version 4.0.2. The connected RH/Red Hat entry reiterates the Missing Authorization issue for this product. Public details in the provide...

WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerability

Unauthenticated Access Token Change/Reset vulnerability discovered by Dave Jong Patchstack in WordPress Plugin WooCommerce AWeber Newsletter Subscription versions = 4.0.2...

CVE-2024-33275

SQL injection vulnerability in Webbax supernewsletter v.1.4.21 and before allows a remote attacker to escalate privileges via the Super Newsletter module in the productsearch.php components...

WordPress WooCommerce AWeber Newsletter Subscription Plugin <= 4.0.2 is vulnerable to Settings Change

Software WooCommerce AWeber Newsletter Subscription Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-33944 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 016ccf61bb0f Credits Da...

CVE-2024-33275

The CVE describes a SQL injection affecting Webbax supernewsletter v1.4.21 and earlier, via the product_search.php component of the Super Newsletter module. The root cause is an SQL injection that enables a remote attacker to escalate privileges, with impact described as high confidentiality, int...

WordPress ENL Newsletter plugin <= 1.0.1 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by Bob Matyas in WordPress Plugin ENL Newsletter versions = 1.0.1...

WordPress ENL Newsletter plugin <= 1.0.1 - Campaign Deletion via CSRF vulnerability

Campaign Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin ENL Newsletter versions = 1.0.1...

WordPress ENL Newsletter plugin <= 1.0.1 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin ENL Newsletter versions = 1.0.1...

CVE-2024-3058

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-3060

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks...

CVE-2024-3059

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack...

CVE-2024-3059

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack...

CVE-2024-3058

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-3060

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks...

CVE-2024-3060 ENL Newsletter <= 1.0.1 - Admin+ SQL Injection

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks...

CVE-2024-3058

CVE-2024-3058 affects the ENL Newsletter WordPress plugin up to version 1.0.1. The issue is due to absent CSRF checks in some areas and missing sanitization/escaping, which could let a logged-in admin inject Stored XSS payloads via a CSRF attack. Public references indicate this vulnerability with...

CVE-2024-3059

The CVE CVE-2024-3059 affects the ENL Newsletter WordPress plugin (versions ≤ 1.0.1). It reports CSRF checks missing in certain areas, enabling CSRF attackers to make logged-in admins delete arbitrary campaigns. Public details in connected docs confirm impact and affected software but do not prov...