Newsletters
Monthly
Cross-Site Request Forgery in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated attackers to overwrite arbitrary plugin settings - including API credentials - by tricking a logged-in administrator into submitting a crafted request. The vulnerability arises from a complete absence of nonce verification and capability checks on the settings-save endpoint, meaning the plugin blindly applies every submitted parameter. A publicly available proof-of-concept exploit exists per WPScan, though EPSS sits at 0.10%, suggesting opportunistic mass exploitation has not yet materialized.
Predictable API key generation in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated network-accessible attackers who successfully derive the key to perform privileged API operations - including adding or deleting subscribers and sending bulk emails. Exploitation requires the plugin's optional API feature to be enabled. A publicly available proof-of-concept exists via WPScan, though EPSS stands at 0.10% (1st percentile), indicating minimal observed exploitation at time of analysis and no CISA KEV listing.
Authorization bypass in the Newsletters plugin for WordPress (all versions up to and including 4.17) allows authenticated attackers holding at minimum author-level access to send mass emails to any WordPress user role - including administrators - by forging the newsletters_mailinglistsroles POST field during ordinary post submission. The forged role slug is passed unchecked directly to WordPress's get_users() function, enabling the attacker to weaponize the site's own trusted outbound email channel for phishing campaigns targeting privileged accounts. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and common provisioning of author accounts on multi-contributor sites make exploitation realistic.
Authentication bypass in the Newsletters WordPress plugin (all versions before 4.16) allows remote unauthenticated attackers to gain privileged API access via PHP type juggling against a non-strict key comparison. Exploitation is conditional on the plugin's optional API being enabled, but when active, attackers can modify subscriber records and send bulk emails without any credentials. A publicly available proof-of-concept is documented by WPScan; EPSS at 0.19% (9th percentile) suggests limited automated exploitation to date, and no CISA KEV listing has been issued.
PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attackers to supply arbitrary serialized PHP objects through a public-facing form, bypassing class restrictions entirely. If a suitable PHP gadget chain is present in the WordPress environment - commonly introduced by co-installed plugins or PHP libraries - this can escalate to remote code execution, data exfiltration, or full site compromise. A publicly available exploit has been confirmed by WPScan; however, EPSS stands at 0.16% (5th percentile), indicating limited observed mass exploitation at time of analysis despite the public PoC.
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attackers to force the hosting server to issue HTTP requests to arbitrary internal or external URLs via the unauthenticated bounce-processing endpoint. A publicly available proof-of-concept exists per WPScan reporting. Despite the high CVSS score of 8.2, EPSS is very low at 0.14% (3rd percentile), and SSVC rates it non-automatable with only partial technical impact, suggesting opportunistic rather than mass exploitation at this time.
Unauthenticated PHP object injection in the Newsletters WordPress plugin before 4.15 lets remote attackers deserialize attacker-controlled data submitted through a public-facing form, then leverage a property-oriented gadget chain bundled inside the plugin itself to write arbitrary files and achieve remote code execution on the host. Publicly available exploit code exists (published via WPScan), though there is no public exploit identified as being used in active attacks and the flaw is not listed in CISA KEV. The self-contained gadget chain removes the usual dependency on third-party gadgets, making reliable exploitation notably more achievable than typical POI bugs.
Reflected cross-site scripting in the Tribulant Software Newsletters (newsletters-lite) WordPress plugin, affecting all versions up through 4.14, lets a remote attacker execute arbitrary JavaScript in a victim's browser when the victim is lured into clicking a crafted link. Reported by Patchstack and rated CVSS 7.1, the scope-changing flaw can lead to session/credential theft or actions performed as the targeted user, including administrators. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Unauthenticated time-based SQL injection in the Newsletters plugin for WordPress (versions up to and including 4.13) allows remote attackers to extract sensitive database contents via the 'wpmlsubscriber_id' parameter. The flaw stems from insufficient input escaping and lack of prepared statements, and no public exploit identified at time of analysis. The CVSS 7.5 score reflects confidentiality-only impact with no required authentication or user interaction.
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive system data including database credentials and API keys through specially crafted placeholder syntax that bypasses existing validation controls. An attacker with email template editing permissions can leverage this vulnerability to access confidential configuration information from the system. A patch is available to address the ineffective placeholder sanitization mechanism.
The Newsletters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.9.9 via the 'file' parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video shortcode in all versions up to, and including, 4.9.9.4 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.9.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS.9.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in Tribulant Software Newsletters newsletters-lite.8.8. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated attackers to overwrite arbitrary plugin settings - including API credentials - by tricking a logged-in administrator into submitting a crafted request. The vulnerability arises from a complete absence of nonce verification and capability checks on the settings-save endpoint, meaning the plugin blindly applies every submitted parameter. A publicly available proof-of-concept exploit exists per WPScan, though EPSS sits at 0.10%, suggesting opportunistic mass exploitation has not yet materialized.
Predictable API key generation in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated network-accessible attackers who successfully derive the key to perform privileged API operations - including adding or deleting subscribers and sending bulk emails. Exploitation requires the plugin's optional API feature to be enabled. A publicly available proof-of-concept exists via WPScan, though EPSS stands at 0.10% (1st percentile), indicating minimal observed exploitation at time of analysis and no CISA KEV listing.
Authorization bypass in the Newsletters plugin for WordPress (all versions up to and including 4.17) allows authenticated attackers holding at minimum author-level access to send mass emails to any WordPress user role - including administrators - by forging the newsletters_mailinglistsroles POST field during ordinary post submission. The forged role slug is passed unchecked directly to WordPress's get_users() function, enabling the attacker to weaponize the site's own trusted outbound email channel for phishing campaigns targeting privileged accounts. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and common provisioning of author accounts on multi-contributor sites make exploitation realistic.
Authentication bypass in the Newsletters WordPress plugin (all versions before 4.16) allows remote unauthenticated attackers to gain privileged API access via PHP type juggling against a non-strict key comparison. Exploitation is conditional on the plugin's optional API being enabled, but when active, attackers can modify subscriber records and send bulk emails without any credentials. A publicly available proof-of-concept is documented by WPScan; EPSS at 0.19% (9th percentile) suggests limited automated exploitation to date, and no CISA KEV listing has been issued.
PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attackers to supply arbitrary serialized PHP objects through a public-facing form, bypassing class restrictions entirely. If a suitable PHP gadget chain is present in the WordPress environment - commonly introduced by co-installed plugins or PHP libraries - this can escalate to remote code execution, data exfiltration, or full site compromise. A publicly available exploit has been confirmed by WPScan; however, EPSS stands at 0.16% (5th percentile), indicating limited observed mass exploitation at time of analysis despite the public PoC.
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attackers to force the hosting server to issue HTTP requests to arbitrary internal or external URLs via the unauthenticated bounce-processing endpoint. A publicly available proof-of-concept exists per WPScan reporting. Despite the high CVSS score of 8.2, EPSS is very low at 0.14% (3rd percentile), and SSVC rates it non-automatable with only partial technical impact, suggesting opportunistic rather than mass exploitation at this time.
Unauthenticated PHP object injection in the Newsletters WordPress plugin before 4.15 lets remote attackers deserialize attacker-controlled data submitted through a public-facing form, then leverage a property-oriented gadget chain bundled inside the plugin itself to write arbitrary files and achieve remote code execution on the host. Publicly available exploit code exists (published via WPScan), though there is no public exploit identified as being used in active attacks and the flaw is not listed in CISA KEV. The self-contained gadget chain removes the usual dependency on third-party gadgets, making reliable exploitation notably more achievable than typical POI bugs.
Reflected cross-site scripting in the Tribulant Software Newsletters (newsletters-lite) WordPress plugin, affecting all versions up through 4.14, lets a remote attacker execute arbitrary JavaScript in a victim's browser when the victim is lured into clicking a crafted link. Reported by Patchstack and rated CVSS 7.1, the scope-changing flaw can lead to session/credential theft or actions performed as the targeted user, including administrators. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Unauthenticated time-based SQL injection in the Newsletters plugin for WordPress (versions up to and including 4.13) allows remote attackers to extract sensitive database contents via the 'wpmlsubscriber_id' parameter. The flaw stems from insufficient input escaping and lack of prepared statements, and no public exploit identified at time of analysis. The CVSS 7.5 score reflects confidentiality-only impact with no required authentication or user interaction.
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive system data including database credentials and API keys through specially crafted placeholder syntax that bypasses existing validation controls. An attacker with email template editing permissions can leverage this vulnerability to access confidential configuration information from the system. A patch is available to address the ineffective placeholder sanitization mechanism.
The Newsletters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.9.9 via the 'file' parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video shortcode in all versions up to, and including, 4.9.9.4 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.9.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS.9.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in Tribulant Software Newsletters newsletters-lite.8.8. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.