Plugin icon

Newsletters

newsletters-lite

Vulnerabilities:

23

Last Updated:

February 3, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2025-12-31
Title
Newsletters < 4.12 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 4.12
CVSS
8.1 (high)
Published
2025-12-28
Title
Newsletters < 4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.13
CVSS
6.4 (medium)
Published
2025-07-29
Title
Newsletters < 4.11 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 4.11
CVSS
8.1 (high)
Published
2025-07-16
Title
Newsletters < 4.11 - Cross-Site Request Forgery
Fixed in
Fixed in 4.11
CVSS
4.3 (medium)
Published
2025-05-30
Title
Newsletters < 4.10 - Authenticated (Administrator+) Local File Inclusion
Fixed in
Fixed in 4.10
CVSS
7.2 (high)
Published
2025-05-12
Title
Newsletters < 4.9.9.9 - Authenticated (Contributor+) SQL Injection orderby Parameter
Fixed in
Fixed in 4.9.9.9
CVSS
6.5 (medium)
Published
2025-03-27
Title
Newsletters < 4.9.9.8 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 4.9.9.8
CVSS
4.9 (medium)
Published
2025-03-25
Title
Newsletters < 4.9.9.8 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 4.9.9.8
CVSS
7.2 (high)
Published
2025-03-21
Title
Newsletters < 4.9.9.8 - Reflected Cross-Site Scripting via To Parameter
Fixed in
Fixed in 4.9.9.8
CVSS
6.1 (medium)
Published
2024-12-26
Title
Newsletters < 4.9.9.7 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.9.9.7
CVSS
6.1 (medium)
Published
2024-10-28
Title
Newsletters < 4.9.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode
Fixed in
Fixed in 4.9.9.5
CVSS
6.4 (medium)
Published
2024-09-27
Title
Newsletters < 4.9.9.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.9.9.2
CVSS
6.1 (medium)
Published
2024-09-05
Title
Newsletters < 4.9.9.3 - Authenticated Privilege Escalation
Fixed in
Fixed in 4.9.9.3
CVSS
8.8 (high)
Published
2024-08-16
Title
Newsletters < 4.9.9 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.9.9
CVSS
6.1 (medium)
Published
2024-08-14
Title
Newsletters < 4.9.9.1 - Unauthenticated Full Path Disclosure
Fixed in
Fixed in 4.9.9.1
CVSS
5.3 (medium)
Published
2024-06-21
Title
Newsletters < 4.9.8 - Cross-Site Request Forgery
Fixed in
Fixed in 4.9.8
CVSS
4.3 (medium)
Published
2024-06-06
Title
Newsletters < 4.9.6 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.9.6
CVSS
6.1 (medium)
Published
2024-04-22
Title
Newsletters < 4.9.6 - Authenticated (Admin+) Arbitrary File Upload
Fixed in
Fixed in 4.9.6
CVSS
9.1 (critical)
Published
2024-04-22
Title
Newsletters < 4.9.6 - Information Exposure via Log files
Fixed in
Fixed in 4.9.6
CVSS
5.3 (medium)
Published
2023-10-05
Title
Newsletter Lite < 4.9.3 - Admin+ Command Injection
Fixed in
Fixed in 4.9.3
CVSS
6.6 (medium)
Published
2019-07-01
Title
Newsletter Lite < 4.6.19 - Multiple Issues
Fixed in
Fixed in 4.6.19
CVSS
8.8 (high)
Published
2018-03-12
Title
Newsletters Lite < 4.6.8.6 - PHP Object Injection
Fixed in
Fixed in 4.6.8.6
CVSS
9.8 (critical)
Published
2017-05-31
Title
Tribulant Newsletters < 4.6.5 – Multiple Vulnerabilities
Fixed in
Fixed in 4.6.5
CVSS
n/a