8 matches found
CVE-2015-9448
The CVE-2015-9448 issue affects the WordPress SendPress plugin (versions prior to 1.2). The vulnerability is an SQL Injection in the wp-admin/admin.php?page=sp-queue listid parameter. Impact per sources includes manipulation/exfiltration of data via the web interface, with CVSS scores indicating ...
CVE-2024-1588
The SendPress Newsletters WordPress plugin (versions Advanced . This allows high-privilege users, such as administrators, to execute arbitrary scripts. A practical exploit involves injecting a payload like "/> into the Optional Settings of the 'Read More override' parameter and saving the con...
CVE-2024-1589
The SendPress Newsletters WordPress plugin (versions into these fields, which will then execute in the browser of other users. Exploitation details are provided in the documentation, demonstrating successful execution of a JavaScript payload.
CVE-2023-35040
CVE-2023-35040 affects WordPress plugin SendPress Newsletters (versions up to and including 1.23.11.6). The issue is described as a Missing Authorization / Broken Access Control vulnerability in SendPress Newsletters, with unauthenticated access potentially allowed due to insufficient authorizati...
CVE-2023-41729
This CVE affects the WordPress SendPress Newsletters plugin. The vulnerability is a stored XSS issue exploitable by an authenticated admin+ user, affecting plugin versions up to 1.22.3.31. Multiple sources corroborate the issue and indicate remediation by updating to a newer version than 1.22.3.3...
CVE-2023-47517
CVE-2023-47517 is a publicly documented Unauth. Reflected Cross-Site Scripting (XSS) vulnerability affecting the WordPress SendPress Newsletters plugin, specifically versions ≤ 1.23.11.6. The issue allows unauthenticated attackers to inject scripts via the reflected XSS vector, with the exact exp...
CVE-2023-5660
CVE-2023-5660 affects the SendPress Newsletters WordPress plugin and enables Stored Cross-Site Scripting via shortcode attributes in all versions up to 1.22.3.31, with exploitation possible by authenticated contributors or higher. Technical details in connected sources confirm the shortcodes and ...