Plugin icon

SendPress Newsletters

sendpress
Plugin closed

Vulnerabilities:

12

Last Updated:

February 7, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-10-28
Title
SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter
Fixed in
No known fix
CVSS
7.5 (high)
Published
2026-10-06
Title
SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token
Fixed in
No known fix
CVSS
5.3 (medium)
Published
2026-10-06
Title
SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing
Fixed in
No known fix
CVSS
4.3 (medium)
Published
2026-10-05
Title
SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection
Fixed in
No known fix
CVSS
7.5 (high)
Published
2024-03-18
Title
SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Form Settings
Fixed in
No known fix
CVSS
3.5 (low)
Published
2024-03-18
Title
SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Settings
Fixed in
No known fix
CVSS
3.5 (low)
Published
2023-11-07
Title
SendPress Newsletters < 1.24.8.19 - Reflected XSS
Fixed in
Fixed in 1.24.8.19
CVSS
7.1 (high)
Published
2023-11-06
Title
SendPress Newsletters < 1.23.11.6 - Contributor+ Stored XSS
Fixed in
Fixed in 1.23.11.6
CVSS
5.9 (medium)
Published
2023-10-02
Title
SendPress Newsletters <= 1.26.1.20 - Admin+ Stored XSS
Fixed in
No known fix
CVSS
3.5 (low)
Published
2023-09-05
Title
SendPress Newsletters <= 1.26.1.20 - CSRF
Fixed in
No known fix
CVSS
4.3 (medium)
Published
2020-07-13
Title
SendPress Newsletter < 1.20.7.13 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.20.7.13
CVSS
3.5 (low)
Published
2015-07-23
Title
SendPress Newsletters < 1.2 - Authenticated SQL Injection
Fixed in
Fixed in 1.2
CVSS
6.7 (medium)