1688 matches found
Newsletter < 7.4.5 - Cross-Site Scripting
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $SERVER'REQUESTURI' before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as...
Newsletter < 7.6.9 - Cross-Site Scripting
The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators id: CVE-2023-27922 info: name: Newsletter 7.6.9 - Cross-Site Scripting author: r3Y3r53 severity: medium...
Tautulli <= 2.16.1 - Path Traversal
Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...
WordPress Email Newsletter - Reflected XSS
WordPress Email Newsletter plugin through 1.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to cra...
CVE-2026-66596
Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...
CVE-2026-66596
An unauthenticated Cross-Site Scripting (XSS) vulnerability affects the WordPress Newsletter plugin in versions 9.3.3 and earlier . The flaw allows an unauthenticated attacker to inject and execute arbitrary scripts in the context of a victim's browser, requiring user interaction. The CVSS 3.1 ba...
CVE-2026-66596 WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...
EUVD-2026-62374
Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...
PT-2026-78330
Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...
CVE-2026-28182
Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...
EUVD-2026-57961
Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...
CVE-2026-28182 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...
CVE-2026-28182
CVE-2026-28182 describes a Subscriber Cross Site Scripting (XSS) vulnerability in the WordPress AcyMailing SMTP Newsletter plugin, affecting versions up to and including 10.11.1. The available documents confirm the vulnerability is XSS but do not provide details on the exact vulnerable component ...
CVE-2026-28182
Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...
CVE-2026-28181
CVE-2026-28181 concerns the WordPress AcyMailing SMTP Newsletter plugin, affected in versions up to 10.11.1. The issue is described as a Broken Access Control vulnerability, enabling unauthorized access to certain resources due to insufficient access restrictions. Based on the provided metrics, t...
CVE-2026-28181
Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...
CVE-2026-28181 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...
EUVD-2026-57960
Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...