What’s Vulnerable › Products
contrid Newsletters vulnerabilities
29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your contrid Newsletters version is affected
Latest contrid Newsletters vulnerabilities
- CVE-2026-101325 — Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter (CVSS 5.3)
- CVE-2026-16264 — Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR (CVSS 6.5)
- CVE-2026-17522 — Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF (CVSS 5.4)
- CVE-2026-17520 — Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key (CVSS 4.8)
- CVE-2026-75908 — Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter (CVSS 4.3)
- CVE-2026-16269 — Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling (CVSS 4.8)
- CVE-2026-16267 — Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field (CVSS 8.1)
- CVE-2026-16268 — Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler (CVSS 8.2)
- CVE-2026-12939 — Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute (CVSS 6.4)
- CVE-2026-12938 — Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute (CVSS 6.4)
- CVE-2026-12583 — Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field (CVSS 8.1)
- CVE-2026-3018 — Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter (CVSS 7.5)
- CVE-2025-4857 — Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion (CVSS 7.2)
- CVE-2025-3107 — Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter (CVSS 6.5)
- CVE-2025-2009 — Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- CVE-2024-13739 — Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter (CVSS 6.1)
- CVE-2024-10181 — Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode (CVSS 6.4)
- CVE-2024-8247 — Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation (CVSS 8.8)
- CVE-2024-43279 — WordPress Newsletters plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2024-7411 — Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure (CVSS 5.3)
- CVE-2024-37227 — WordPress Newsletters plugin <= 4.9.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- CVE-2024-35718 — WordPress Newsletters plugin <= 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- CVE-2024-32954 — WordPress Newsletters plugin <= 4.9.5 - Arbitrary File Upload vulnerability (CVSS 9.1)
- CVE-2024-32953 — WordPress Newsletters plugin <= 4.9.5 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- CVE-2023-4797 — Newsletter Lite < 4.9.3 - Admin+ Command Injection (CVSS 7.2)