Contrid
Monthly
Unauthenticated time-based SQL injection in the Newsletters plugin for WordPress (versions up to and including 4.13) allows remote attackers to extract sensitive database contents via the 'wpmlsubscriber_id' parameter. The flaw stems from insufficient input escaping and lack of prepared statements, and no public exploit identified at time of analysis. The CVSS 7.5 score reflects confidentiality-only impact with no required authentication or user interaction.
Authorization bypass in the Newsletters plugin for WordPress (all versions up to and including 4.17) allows authenticated attackers holding at minimum author-level access to send mass emails to any WordPress user role - including administrators - by forging the newsletters_mailinglistsroles POST field during ordinary post submission. The forged role slug is passed unchecked directly to WordPress's get_users() function, enabling the attacker to weaponize the site's own trusted outbound email channel for phishing campaigns targeting privileged accounts. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and common provisioning of author accounts on multi-contributor sites make exploitation realistic.
Stored Cross-Site Scripting in the Slideshow Gallery LITE WordPress plugin (all versions through 1.8.5) allows authenticated attackers with Contributor-level access to persistently inject arbitrary JavaScript via the 'alwaysauto' shortcode attribute, which then executes in the browser of any user who visits the affected page. The root cause is insufficient input sanitization and output escaping on user-supplied shortcode attributes, a classic CWE-79 pattern. The scope change in the CVSS vector (S:C) reflects that the injected script runs outside the plugin's security context - in victim users' browsers - enabling session hijacking, credential theft, or admin account takeover. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated time-based SQL injection in the Newsletters plugin for WordPress (versions up to and including 4.13) allows remote attackers to extract sensitive database contents via the 'wpmlsubscriber_id' parameter. The flaw stems from insufficient input escaping and lack of prepared statements, and no public exploit identified at time of analysis. The CVSS 7.5 score reflects confidentiality-only impact with no required authentication or user interaction.
Authorization bypass in the Newsletters plugin for WordPress (all versions up to and including 4.17) allows authenticated attackers holding at minimum author-level access to send mass emails to any WordPress user role - including administrators - by forging the newsletters_mailinglistsroles POST field during ordinary post submission. The forged role slug is passed unchecked directly to WordPress's get_users() function, enabling the attacker to weaponize the site's own trusted outbound email channel for phishing campaigns targeting privileged accounts. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and common provisioning of author accounts on multi-contributor sites make exploitation realistic.
Stored Cross-Site Scripting in the Slideshow Gallery LITE WordPress plugin (all versions through 1.8.5) allows authenticated attackers with Contributor-level access to persistently inject arbitrary JavaScript via the 'alwaysauto' shortcode attribute, which then executes in the browser of any user who visits the affected page. The root cause is insufficient input sanitization and output escaping on user-supplied shortcode attributes, a classic CWE-79 pattern. The scope change in the CVSS vector (S:C) reflects that the injected script runs outside the plugin's security context - in victim users' browsers - enabling session hijacking, credential theft, or admin account takeover. No public exploit or CISA KEV listing has been identified at time of analysis.