WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
newsletter-optin-box
Published
2025-06-12
Title
Noptin < 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
newsletter-optin-box
Published
2026-08-24
Title
Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page
Slug
newsletter-page-redirects
Published
2024-12-18
Title
AI Magic < 1.0.6 - Unauthenticated Privilege Escalation
Slug
newsletter-popup
Published
2023-05-02
Title
Newsletter Popup <= 1.2 - Unauthenticated Stored XSS
Slug
newsletter-popup
Published
2023-05-02
Title
Newsletter Popup <= 1.2 - Record Deletion via CSRF
Slug
newsletter-popup
Published
2024-04-25
Title
Newsletter Popup <= 1.2 - Admin+ Stored XSS
Slug
newsletter-popup
Published
2024-04-25
Title
Newsletter Popup <= 1.2 - List Deletion via CSRF
Slug
newsletter-popup
Published
2024-04-25
Title
Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF
Slug
newsletter-popup
Published
2024-04-25
Title
Newsletter Popup <= 1.2 - Unauthenticated Stored XSS
Slug
newsletter-subscription-widget-for-sendblaster
Published
2025-08-25
Title
Newsletter subscription optin module <= 1.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
newsletter-subscriptions
Published
2024-12-11
Title
Newsletter Subscriptions <= 2.1 - Reflected Cross-Site Scripting
Slug
newsletter2go
Published
2024-03-11
Title
Newsletter2Go <= 4.0.13 - Authenticated(Subscriber+) Stored Cross-Site Scripting via style
Slug
newsletter2go
Published
2025-01-08
Title
Newsletter2Go <= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style Reset
Slug
newsletters-from-rss-to-email-newsletters-using-nourish
Published
2025-12-04
Title
Nouri.sh Newsletter <= 1.0.1.3 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Slug
newsletters-lite
Published
2017-05-31
Title
Tribulant Newsletters < 4.6.5 – Multiple Vulnerabilities
Slug
newsletters-lite
Published
2019-07-01
Title
Newsletter Lite < 4.6.19 - Multiple Issues
Slug
newsletters-lite
Published
2018-03-12
Title
Newsletters Lite < 4.6.8.6 - PHP Object Injection
Slug
newsletters-lite
Published
2023-10-05
Title
Newsletter Lite < 4.9.3 - Admin+ Command Injection
Slug
newsletters-lite
Published
2024-04-22
Title
Newsletters < 4.9.6 - Authenticated (Admin+) Arbitrary File Upload
Slug
newsletters-lite
Published
2024-04-22
Title
Newsletters < 4.9.6 - Information Exposure via Log files
Slug
newsletters-lite
Published
2024-06-06
Title
Newsletters < 4.9.6 - Reflected Cross-Site Scripting
Slug
newsletters-lite
Published
2024-06-21
Title
Newsletters < 4.9.8 - Cross-Site Request Forgery
Slug
newsletters-lite
Published
2024-08-14
Title
Newsletters < 4.9.9.1 - Unauthenticated Full Path Disclosure
Slug
newsletters-lite
Published
2024-08-16
Title
Newsletters < 4.9.9 - Reflected Cross-Site Scripting
Slug
newsletters-lite
Published
2024-09-05
Title
Newsletters < 4.9.9.3 - Authenticated Privilege Escalation