Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-18
Newsletter - Security Vulnerability (CVE-2026-90981)
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires the victim to be a logged-in administrator, as the antibot check auto-passes for authenticated users, routing the…
PLUGIN
Newsletter
CVE-2026-90981
Risk Score
Threat Entry
Updated 2026-09-18
Newsletter - Security Vulnerability (CVE-2026-86824)
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
PLUGIN
Newsletter
CVE-2026-86824
Risk Score
Threat Entry
Updated 2026-09-17
Newsletter - Security Vulnerability (CVE-2026-86823)
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber record's front-end actions.
PLUGIN
Newsletter
CVE-2026-86823
Risk Score
Threat Entry
Updated 2026-08-20
Newsletter - Cross-Site Scripting (XSS) (CVE-2026-66596)
Unauthenticated Cross Site Scripting (XSS) in Newsletter
PLUGIN
Newsletter
CVE-2026-66596
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Request Forgery (CSRF) (CVE-2026-1051)
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1.0. This is due to missing or incorrect nonce validation on the hook_newsletter_action() function. This makes it possible for unauthenticated attackers to unsubscribe newsletter subscribers via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.
PLUGIN
Newsletter
CVE-2026-1051
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - SQL Injection (CVE-2025-67999)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stefano Lissa Newsletter newsletter allows Blind SQL Injection.This issue affects Newsletter: from n/a through
PLUGIN
Newsletter
CVE-2025-67999
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Scripting (XSS) (CVE-2025-3582)
The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Newsletter
CVE-2025-3582
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Scripting (XSS) (CVE-2025-3581)
The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Newsletter
CVE-2025-3581
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Scripting (XSS) (CVE-2025-3584)
The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Newsletter
CVE-2025-3584
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Scripting (XSS) (CVE-2025-3583)
The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Newsletter
CVE-2025-3583
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Security Vulnerability (CVE-2024-5674)
The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP version below 8.0
PLUGIN
Newsletter
CVE-2024-5674
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Scripting (XSS) (CVE-2024-5317)
The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Newsletter
CVE-2024-5317
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Scripting (XSS) (CVE-2023-4772)
The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletter_form' shortcode in versions up to, and including, 7.8.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Newsletter
CVE-2023-4772
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Scripting (XSS) (CVE-2023-27922)
Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary script.
PLUGIN
Newsletter
CVE-2023-27922
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Scripting (XSS) (CVE-2022-1889)
The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed
PLUGIN
Newsletter
CVE-2022-1889
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Scripting (XSS) (CVE-2022-1756)
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
PLUGIN
Newsletter
CVE-2022-1756
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - PHP Object Injection (CVE-2020-35932)
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.
PLUGIN
Newsletter
CVE-2020-35932
Risk Score
Threat Entry
Updated 2026-06-17
Newsletter - Cross-Site Scripting (XSS) (CVE-2020-35933)
A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.
PLUGIN
Newsletter
CVE-2020-35933
Risk Score