CVE-2026-78146

The Simple Newsletter Plugin for WordPress (versions before 4.3.3 ) is vulnerable to an information disclosure flaw. The plugin fails to verify the identity of a requester against the subscriber named in a public request before rendering stored details. This allows unauthenticated users to access...

CVE-2025-14348: Improper Authorization

The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's REST API trusting the x-wemail-user HTTP header to identif...