Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, wri...

WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection

Newsletters WordPress plugin = 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriberid' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-3018 info: name: WordPress Newsletters = 4.13 - Unauthenticated SQL...

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler

Newsletters WordPress plugin 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts. id: CVE-2026-16268 info: name: Newsletters 4.16 -...

CVE-2025-30921

CVE-2025-30921 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Newsletters Vulnerable version = 4.9.9.7 Component slug newsletters-lite Component link https://wordpress.org/plugins/newsletters-lite/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection Vulnerability type...

CVE-2014-4725

CVE-2014-4725 this script is used to scan and exploit cve-2014-4725 vulnerability mailpoet/wysija newsletters in wordpress. features scan mode detect wordpress targets vulnerable to cve-2014-4725 exploit mode upload a zip payload to vulnerable targets installation 1. clone the repository: git clo...

CVE-2026-101325

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-101325

The Newsletters plugin for WordPress (versions up to and including 4.18.1 ) is vulnerable to a time-based SQL Injection via the 'id' parameter . The root cause is insufficient escaping of user-supplied input and a lack of proper query preparation. This allows authenticated attackers with subscrib...

CVE-2026-101325 Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-101325 Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2026-114678

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2026-134480

Name of the Vulnerable Software and Affected Versions Newsletters plugin for WordPress versions prior to 4.18.2 Description Authenticated attackers with subscriber-level access and above can perform a time-based SQL Injection. This occurs due to insufficient escaping of the user-supplied id...

CVE-2026-101325: contrid Newsletters: The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions…

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

WordPress Newsletters plugin <= 4.18.1 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin Newsletters versions = 4.18.1...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. This script is a "sanized-version" of original script avalible on...

CVE-2026-93855

The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-93855

The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection in all versions up to and including 1.26.1.20 . The flaw exists in the 'subscriberid' parameter due to insufficient escaping of user-supplied input and a lack of sufficient preparation in the existing SQL que...

CVE-2026-93855 SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter

The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-93855 SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter

The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

EUVD-2026-112587

The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...