8 matches found
CVE-2015-9448
The CVE-2015-9448 issue affects the WordPress SendPress plugin (versions prior to 1.2). The vulnerability is an SQL Injection in the wp-admin/admin.php?page=sp-queue listid parameter. Impact per sources includes manipulation/exfiltration of data via the web interface, with CVSS scores indicating ...
CVE-2024-1588
The SendPress Newsletters WordPress plugin (versions Advanced . This flaw allows high-privilege users, such as administrators, to execute malicious scripts even when the unfiltered_html capability is disallowed (e.g., in a multisite setup). Practical exploitation involves injecting a payload like...
CVE-2024-1589
The SendPress Newsletters WordPress plugin (versions  into these parameters. Remediation requires updating the plugin to a version later than 1.23.11.6 . As a temporary workaround, administrators should restrict access to the plugin's settings.
CVE-2023-35040
CVE-2023-35040 affects WordPress plugin SendPress Newsletters (versions up to and including 1.23.11.6). The issue is described as a Missing Authorization / Broken Access Control vulnerability in SendPress Newsletters, with unauthenticated access potentially allowed due to insufficient authorizati...
CVE-2023-41729
This CVE affects the WordPress SendPress Newsletters plugin. The vulnerability is a stored XSS issue exploitable by an authenticated admin+ user, affecting plugin versions up to 1.22.3.31. Multiple sources corroborate the issue and indicate remediation by updating to a newer version than 1.22.3.3...
CVE-2023-47517
CVE-2023-47517 is a publicly documented Unauth. Reflected Cross-Site Scripting (XSS) vulnerability affecting the WordPress SendPress Newsletters plugin, specifically versions ≤ 1.23.11.6. The issue allows unauthenticated attackers to inject scripts via the reflected XSS vector, with the exact exp...
CVE-2023-5660
CVE-2023-5660 affects the SendPress Newsletters WordPress plugin and enables Stored Cross-Site Scripting via shortcode attributes in all versions up to 1.22.3.31, with exploitation possible by authenticated contributors or higher. Technical details in connected sources confirm the shortcodes and ...