80 matches found
CVE-2026-92989
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue...
CVE-2026-92990
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses...
CVE-2026-92989 SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue...
CVE-2026-92990 SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses...
EUVD-2026-95501
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue...
EUVD-2026-95502
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses...
CVE-2026-92989
The SendPress Newsletters WordPress plugin (versions up to and including 1.26.1.20 ) contains a vulnerability where it fails to verify user capabilities during specific newsletter-management actions. This flaw allows any authenticated subscriber-level user to perform unauthorized actions, specifi...
CVE-2026-92990
The SendPress Newsletters WordPress plugin, version 1.26.1.20 and below, is vulnerable to an unauthenticated newsletter sending log disclosure . The root cause is a hardcoded token used to protect a logging endpoint; because this token is identical across all installations instead of being a uniq...
CVE-2026-39795
Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...
EUVD-2026-93039
Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...
CVE-2026-39795
The SendPress Newsletters plugin for WordPress (versions
CVE-2026-39795 WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability
Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...
CVE-2026-39795 WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability
Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...
PT-2026-106461
Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...
WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Aydan Arabadzha in WordPress Plugin SendPress Newsletters versions = 1.26.1.20...
WordPress SendPress Newsletters plugin <= 1.23.11.6 - Admin+ Stored XSS via Settings vulnerability
Admin+ Stored XSS via Settings vulnerability discovered by Manab Jyoti Dowarah in WordPress Plugin SendPress Newsletters versions = 1.23.11.6...
WordPress SendPress Newsletters plugin <= 1.23.11.6 - Admin+ Stored XSS via Form Settings vulnerability
Admin+ Stored XSS via Form Settings vulnerability discovered by Manab Jyoti Dowarah in WordPress Plugin SendPress Newsletters versions = 1.23.11.6...
EUVD-2023-46221
Malicious code in bioql PyPI...