WordPress Plugin Vulnerabilities

ENL Newsletter 1.0.1 - wp-admin/admin.php enl-add-new Page id Parameter SQL Injection

Description

The ENL Newsletter WordPress plugin was affected by a wp-admin/admin.php enl-add-new Page id Parameter SQL Injection security vulnerability.

Affects Plugins

Plugin icon
enl-newsletter
No known fix

References

CVE
CVE-2014-4939
URL
https://codevigilant.com/disclosure/wp-plugin-enl-newsletter-a1-injection/

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89

Miscellaneous

Verified
No
WPVDB ID
bde965f6-162d-4be0-8ff5-a768151922ba

Timeline

Publicly Published
2014-08-01 (about 11 years ago)
Added
2014-08-01 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)

Other

Published
Title
Published
2024-02-09
Title
Awesome Support – WordPress HelpDesk & Support Plugin < 6.1.8 - Authenticated (Subscriber+) SQL Injection
Published
2025-12-14
Title
Accordion Slider PRO < 1.3 - Authenticated (Contributor+) SQL Injection
Published
2024-12-02
Title
BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter
Published
2026-03-20
Title
Fonts Manager | Custom Fonts <= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter
Published
2025-10-14
Title
WP Dashboard Chat <= 1.0.3 - Authenticated (Contributor+) SQL Injection via id