Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler

Newsletters WordPress plugin 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts. id: CVE-2026-16268 info: name: Newsletters 4.16 -...

WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection

Newsletters WordPress plugin = 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriberid' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-3018 info: name: WordPress Newsletters = 4.13 - Unauthenticated SQL...

CVE-2014-4725

CVE-2014-4725 this script is used to scan and exploit cve-2014-4725 vulnerability mailpoet/wysija newsletters in wordpress. features scan mode detect wordpress targets vulnerable to cve-2014-4725 exploit mode upload a zip payload to vulnerable targets installation 1. clone the repository: git clo...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. This script is a "sanized-version" of original script avalible on...

CVE-2026-94075

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1...

CVE-2026-111402

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1...

EUVD-2026-109249

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1...

CVE-2026-94075 WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1...

CVE-2026-94075

The Tribulant Software Newsletters (newsletters-lite) WordPress plugin, versions 4.18.1 and earlier , is vulnerable to a PHP Object Injection flaw. This issue stems from the deserialization of untrusted data , which can allow an attacker to perform Object Injection . The documents do not provide ...

EUVD-2026-109247

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1...

CVE-2026-111402 WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1...

CVE-2026-111402

The Tribulant Software Newsletters (newsletters-lite) WordPress plugin versions 4.18.1 and below is vulnerable to an SQL Injection flaw due to the improper neutralization of special elements used in SQL commands. This vulnerability allows an attacker to execute unauthorized SQL commands. No speci...

CVE-2025-30921

CVE-2025-30921 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Newsletters Vulnerable version = 4.9.9.7 Component slug newsletters-lite Component link https://wordpress.org/plugins/newsletters-lite/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection Vulnerability type...

PT-2026-122530

Name of the Vulnerable Software and Affected Versions Newsletters versions prior to 4.18.2 Description Deserialization of untrusted data in the Newsletters plugin allows for Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere wi...

WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Newsletters versions = 4.18.1...

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Noverdi Anugrah Ramadhan in WordPress Plugin Newsletters versions = 4.18.1...

CVE-2026-109515

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribetoemaillist endpoint accepting an attacker-supplied...

EUVD-2026-102644

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribetoemaillist endpoint accepting an attacker-supplied...

CVE-2026-109515: Improper Privilege Management

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribetoemaillist endpoint accepting an attacker-supplied...