768 matches found
WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection
Newsletters WordPress plugin = 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriberid' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-3018 info: name: WordPress Newsletters = 4.13 - Unauthenticated SQL...
Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler
Newsletters WordPress plugin 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts. id: CVE-2026-16268 info: name: Newsletters 4.16 -...
Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...
CVE-2025-30921
CVE-2025-30921 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Newsletters Vulnerable version = 4.9.9.7 Component slug newsletters-lite Component link https://wordpress.org/plugins/newsletters-lite/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection Vulnerability type...
CVE-2026-83555
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...
CVE-2026-16264
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record...
CVE-2026-83555
The Email Subscribers & Newsletters WordPress plugin (versions before 5.9.35 ) is vulnerable to an unauthenticated subscription status change . The root cause is a failure to verify the per-subscriber management token when updating subscription statuses. This allows unauthenticated users to force...
EUVD-2026-85031
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...
CVE-2026-83555 Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...
WordPress Email Subscribers & Newsletters plugin < 5.9.35 - Unauthenticated Subscription Status Change vulnerability
Unauthenticated Subscription Status Change vulnerability discovered by Usama Arshad in WordPress Plugin Email Subscribers & Newsletters versions 5.9.35...
EUVD-2026-85021
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record...
CVE-2026-16264 Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record...
CVE-2026-16264
The Newsletters WordPress plugin versions before 4.18.1 is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to perform adequate ownership checks on certain subscriber management actions and can issue management sessions to unauthenticated visitors . This allows an a...
CVE-2019-20361-EXPLOIT
CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. This script is a "sanized-version" of original script avalible on...
CVE-2014-4725
CVE-2014-4725 Este script se utiliza para escanear y explotar la vulnerabilidad CVE-2014-4725 MailPoet/Wysija Newsletters en WordPress. Características Modo escaneo detectar objetivos WordPress vulnerables a CVE-2014-4725 Modo explotación subir un payload zip a objetivos vulnerables Instalación 1...
WordPress Newsletters plugin < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling vulnerability
Unauthenticated API Authentication Bypass via Type Juggling vulnerability discovered by Haitam Lazaar in WordPress Plugin Newsletters versions 4.16...
CVE-2026-66619
Administrator SQL Injection in Newsletters = 4.18 versions...
CVE-2026-66619
CVE-2026-66619 is an Administrator SQL Injection vulnerability in the WordPress Newsletters plugin , affecting versions 4.18 and below . The vulnerability was discovered by Ananda Dhakal via Patchstack. The CVSS 3.1 base score is 7.6 (HIGH) with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, in...
