Plugin icon

Newsletter – Send awesome emails from WordPress

newsletter

Vulnerabilities:

19

Last Updated:

January 29, 2026

Active Installs:

200000

Published
Title
Fixed in
CVSS
Published
2026-01-19
Title
Newsletter – Send awesome emails from WordPress < 9.1.1 - Cross-Site Request Forgery to Newsletter Unsubscription
Fixed in
Fixed in 9.1.1
CVSS
4.3 (medium)
Published
2025-12-15
Title
Newsletter < 9.1.0 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 9.1.0
CVSS
4.9 (medium)
Published
2025-05-19
Title
Newsletter < 8.8.5 - Admin+ Stored XSS via Form
Fixed in
Fixed in 8.8.5
CVSS
3.5 (low)
Published
2025-05-19
Title
Newsletter < 8.8.5 - Admin+ Stored XSS via Widget
Fixed in
Fixed in 8.8.5
CVSS
3.5 (low)
Published
2025-05-13
Title
Newsletter < 8.8.2 - Admin+ Stored XSS via Subscription
Fixed in
Fixed in 8.8.2
CVSS
3.5 (low)
Published
2025-04-14
Title
Newsletter < 8.7.1 - Admin+ Stored XSS
Fixed in
Fixed in 8.7.1
CVSS
3.5 (low)
Published
2024-06-04
Title
Newsletter < 8.3.5 - Unauthenticated Stored Cross-Site Scripting via np1
Fixed in
Fixed in 8.3.5
CVSS
6.4 (medium)
Published
2024-03-28
Title
Newsletter < 8.2.1 - IP Spoofing
Fixed in
Fixed in 8.2.1
CVSS
5.3 (medium)
Published
2023-09-06
Title
Newsletter < 7.9.0 - Contributor+ Stored XSS
Fixed in
Fixed in 7.9.0
CVSS
6.8 (medium)
Published
2023-03-27
Title
Newsletter < 7.6.9 - Reflected XSS
Fixed in
Fixed in 7.6.9
CVSS
7.1 (high)
Published
2022-05-30
Title
Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 7.4.6
CVSS
3.4 (low)
Published
2022-05-23
Title
Newsletter < 7.4.5 - Reflected Cross-Site Scripting
Fixed in
Fixed in 7.4.5
CVSS
3.4 (low)
Published
2020-08-03
Title
Newsletter < 6.8.2 - Authenticated PHP Object Injection
Fixed in
Fixed in 6.8.2
CVSS
4.2 (medium)
Published
2020-08-03
Title
Newsletter < 6.8.2 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 6.8.2
CVSS
4.6 (medium)
Published
2020-07-12
Title
Newsletter < 6.7.7 - Authenticated Stored Cross-Site Scripting
Fixed in
Fixed in 6.7.7
CVSS
3.5 (low)
Published
2020-03-16
Title
Newsletter < 6.5.4 - CSV Injection
Fixed in
Fixed in 6.5.4
CVSS
3.1 (low)
Published
2015-03-30
Title
Newsletter 3.7.0 - Open Redirect
Fixed in
Fixed in 3.8.3
CVSS
3.5 (low)
Published
2013-05-14
Title
Newsletter < 3.2.7 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.2.7
CVSS
5.4 (medium)
Published
2013-02-03
Title
Newsletter < 3.0.9 - SQL Injection
Fixed in
Fixed in 3.0.9
CVSS
6.7 (medium)