Newsletter < 7.4.5 - Cross-Site Scripting

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...

Newsletter < 7.6.9 - Cross-Site Scripting

The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators id: CVE-2023-27922 info: name: Newsletter 7.6.9 - Cross-Site Scripting author: r3Y3r53 severity: medium...

Tautulli <= 2.16.1 - Path Traversal

Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...

WordPress Email Newsletter - Reflected XSS

WordPress Email Newsletter plugin through 1.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to cra...

paperweight

Paperweight 웹사이트 Paperweight의 마케팅 사이트입니다. 개발 저장소 루트에서 의존성을 설치한 후 이 패키지에서 Next.js를 실행하세요: root@kitploit: pnpm -C website install pnpm -C website dev 프로덕션 빌드 root@kitploit: pnpm -C website build pnpm -C website start 환경 변수 이 사이트에는 두 개의 서버 측 API 라우트가 있습니다: POST /api/newsletter Resend를 통한 뉴스레터 가입 POS...

CVE-2024-33297

CVE-2024-33297 Microweber = 2.0.9 における格納型クロスサイトスクリプティング（Stored XSS）の脆弱性 概要 : Microweber v.2.0.9 における格納型クロスサイトスクリプティング（Stored XSS）の脆弱性により、リモートの攻撃者が「Add new campaign」機能のキャンペーン名（内部名）フィールドを介して任意のコードを実行できる可能性があります。 要件 : Microweber バージョン = 2.0.9 管理者アクセス権 再現手順 : 1. 管理者権限でアプリケーションに認証する 2. エンドポイント...

CVE-2026-49995

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

EUVD-2026-84069

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

CVE-2026-49995 Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

CVE-2026-49995 Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

CVE-2026-49995: Improper Neutralization of Input During Web Page Generation

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

WordPress Newsletter – Send awesome emails from WordPress plugin <= 9.3.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Newsletter versions = 9.3.8...

CVE-2026-90981

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-90981

The Newsletter – Send awesome emails from WordPress plugin (versions up to and including 9.3.8 ) is vulnerable to Reflected Cross-Site Scripting via the nn parameter, caused by insufficient input sanitization and output escaping in the dienow() function. An unauthenticated attacker can inject arb...

CVE-2026-90981 Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-82751

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-90981 Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-90981: Improper Neutralization of Input During Web Page Generation

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-86824

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session toke...

CVE-2026-86824 Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session toke...