CVE-2026-39795

Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...

CVE-2026-39795 WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability

Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...

CVE-2026-39795

The SendPress Newsletters plugin for WordPress (versions

EUVD-2026-93039

Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...

WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection

Newsletters WordPress plugin = 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriberid' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-3018 info: name: WordPress Newsletters = 4.13 - Unauthenticated SQL...

Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler

Newsletters WordPress plugin 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts. id: CVE-2026-16268 info: name: Newsletters 4.16 -...

CVE-2025-30921

CVE-2025-30921 1️⃣ Tipo de componente Plugin de WordPress 2️⃣ Detalles del componente Nombre del componente Newsletters Versión vulnerable = 4.9.9.7 Slug del componente newsletters-lite Enlace del componente https://wordpress.org/plugins/newsletters-lite/ 3️⃣ OWASP 2017: TOP 10 Clase de...

CVE-2014-4725

CVE-2014-4725 Este script se utiliza para escanear y explotar la vulnerabilidad CVE-2014-4725 MailPoet/Wysija Newsletters en WordPress. Características Modo escaneo detectar objetivos WordPress vulnerables a CVE-2014-4725 Modo explotación subir un payload zip a objetivos vulnerables Instalación 1...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT Hubo una falla en el plugin de WordPress, Email Subscribers & Newsletters anterior a la versión 4.3.1, que permitía pasar sentencias SQL a la base de datos en el parámetro hash una vulnerabilidad de inyección SQL ciega. Este script es una "versión saneada" del script origin...

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

CVE-2026-97074

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

CVE-2026-97074 WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

EUVD-2026-89894

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

CVE-2026-97074 WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

CVE-2026-97074

The Newsletters, Email Marketing, SMS and Popups by Omnisend WordPress plugin versions

WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Elaprendiz1927 in WordPress Plugin Newsletters, Email Marketing, SMS and Popups by Omnisend versions = 1.9.0...

CVE-2026-97074: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

WordPress Newsletters plugin < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure vulnerability

Unauthenticated Subscriber Record Overwrite and PII Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Newsletters versions 4.18.1...

CVE-2026-83555

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

CVE-2026-16264

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record...