EUVD-2026-95501

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue...

CVE-2026-90981: Improper Neutralization of Input During Web Page Generation

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

Pimcore /reports/newsletter/send HOST parameter command execution vulnerability

Pimcore is a purely object-oriented system based on the Zend Framework, written in PHP 5. Pimcore /reports/newsletter/send fails to properly handle the 'HOST' GET parameter, allowing remote attackers to exploit the vulnerability by submitting a special request to execute arbitrary commands...