CVE-2026-66619 WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability

Administrator SQL Injection in Newsletters = 4.18 versions...

WordPress Newsletters plugin < 4.17 - Arbitrary Plugin Option Update vulnerability

Arbitrary Plugin Option Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Newsletters versions 4.17...

WordPress Newsletters plugin < 4.17 - Unauthenticated API Access vulnerability

Unauthenticated API Access vulnerability discovered by Erwan LR WPScan in WordPress Plugin Newsletters versions 4.17...

WordPress Newsletters plugin < 4.16 - Unauthenticated PHP Object Injection via Date Form Field vulnerability

Unauthenticated PHP Object Injection via Date Form Field vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Newsletters versions 4.16...

CVE-2026-12938

The CVE-2026-12938 entry describes a Stored XSS in the WordPress Newsletters Lite plugin (versions up to 4.15). The vulnerability stems from insufficient input sanitization and output escaping in the posts_single() function (injects attacker-controlled target into $wpml_target) and in the shortco...

CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

WordPress Newsletters plugin <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Newsletters versions = 4.15...

CVE-2026-57394 WordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through = 4.14...

WordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Newsletters versions = 4.14...

CVE-2026-57645

CVE-2026-57645 affects the WordPress Newsletters plugin (versions

CVE-2026-57645 WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability

newsletterssubscribers Broken Access Control in Newsletters = 4.13 versions...

CVE-2026-54840 WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Newsletters = 4.13 versions...

CVE-2026-54840 WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Newsletters = 4.13 versions...

CVE-2026-54840

The CVE-2026-54840 entry concerns WordPress Newsletters plugin, versions up to 4.13, with an unauthenticated broken access control flaw. The connected sources confirm the affected product and vulnerability class but do not specify exact vulnerable parameters, affected data, exploit methods, or re...

WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HieuPenguinnn in WordPress Plugin Newsletters versions = 4.13...

CVE-2026-3018

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriberid’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

VulnCheck KEV: CVE-2026-3018

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriberid’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2026-48398

Name of the Vulnerable Software and Affected Versions Newsletters plugin for WordPress versions prior to 4.14 Description The plugin is susceptible to time-based SQL Injection, a technique where an attacker sends queries that force the database to wait a specific amount of time before responding,...

CVE-2025-67911

CVE-2025-67911 describes a Deserialization of Untrusted Data vulnerability in the Tribulant Software Newsletters newsletters-lite plugin. The WordPress/newsletters entry states unauthenticated Object Injection via deserialization, affecting Newsletters: from n/a through