Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
337 results · page 5 of 7
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin <= 4.8.8 versions.CVE-2023-30478 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin <= 4.8.8 versions.
- Affected
- up to 4.8.8
- What to do
- Affects up to 4.8.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023Emails & Newsletters with Jackmail: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46821 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.
- Product
- Emails & Newsletters with Jackmail
- Affected
- up to 1.2.22
- What to do
- Affects up to 1.2.22. Update Emails & Newsletters with Jackmail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023Simple Newsletter Plugin – Noptin: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46803 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsletter Plugin – Noptin: from n/a through 1.9.5.
- Product
- Simple Newsletter Plugin – Noptin
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update Simple Newsletter Plugin – Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45810 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2.
- Product
- Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce
- Affected
- up to 5.5.2
- What to do
- Affects up to 5.5.2. Update Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023SendPress Newsletters: Stored Cross-Site ScriptingCVE-2023-5660 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.22.3.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SendPress Newsletters
- Affected
- up to 1.22.3.31
- What to do
- Affects up to 1.22.3.31. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions.CVE-2023-41730 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions.
- Affected
- up to 1.22.3.31
- What to do
- Affects up to 1.22.3.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 21, 2023Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.CVE-2018-5478 · Other software · Contao · reported by MITREMedium 6.1
Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.
- Product
- Contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Sep 8, 2023FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.CVE-2023-39676 · Other software · Fieldthemes · reported by MITREMedium 6.1
FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.
- Product
- Fieldpopupnewsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sorcery.iesorcery.ie
Sep 6, 2023Newsletter: Stored Cross-Site ScriptingCVE-2023-4772 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletter_form' shortcode in versions up to, and including, 7.8.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Newsletter
- Affected
- up to 7.8.9
- What to do
- Affects up to 7.8.9. Update Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 7, 2023A vulnerability, which was classified as problematic, was found in SimplePHPscripts NewsLetter Script PHP 2.4.CVE-2023-3540 · Other software · SimplePHPscripts · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in SimplePHPscripts NewsLetter Script PHP 2.4. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233292.
- Product
- NewsLetter Script PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023Newsletter Manager: Insecure deserializationCVE-2020-36727 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due to unsanitized input from the 'customFieldsDetails' parameter being passed through a deserialization function. This potentially makes it possible for unauthenticated attackers to inject a serialized PHP object.
- Product
- Newsletter Manager
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpscan.com
Jun 5, 2023Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not sanitise and escape a parameter before outputting it back in the admin dashboardCVE-2023-2472 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when the WPML plugin is also active and configured, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.61
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.61 or newer.
Jun 4, 2023A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress.CVE-2013-10028 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the function style_newsletter of the file lettreinfo.php. The manipulation of the argument email leads to cross site scripting. The attack may be launched remotely. The name of the patch is 3339b42316c5edf73e56eb209b6a3bb3e868d6ed. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230660.
- Affected
- 2.6 to 2.9.0
- What to do
- Affects 2.6 to 2.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Newsletter Popup: Does not have CSRF checks in some placesCVE-2023-0766 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce.
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Newsletter Popup: Does not sanitise and escape some of its settingsCVE-2023-0733 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 22, 2023Newsletter versions prior to 7.6.9: Cross-site scriptingCVE-2023-27922 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary script.
- Product
- Newsletter versions prior to 7.6.9
- Fixed in
- 7.6.9
- What to do
- Update Newsletter versions prior to 7.6.9 to 7.6.9 or newer.
May 8, 2023Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members.CVE-2023-31133 · Other software · TryGhost · reported by GitHubHigh 7.5
Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack. Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().CVE-2023-27032 · Other software · Idnovate · reported by MITRECritical 9.8
Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().
- Product
- Popup Module (on Entering, Exit Popup, ADD Product) And Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comfriends-of-presta.github.io
Mar 30, 2023AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when accesCVE-2023-28733 · Other software · AcyMailing · reported by vulnerability@ncsc.chHigh 7.2
AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
- Product
- Newsletter Plugin for Joomla in the Enterprise version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacymailing.combugbounty.ch
Mar 30, 2023Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system CVE-2023-28732 · Other software · AcyMailing · reported by vulnerability@ncsc.chMedium 6.5
Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin in versions below 8.3.0.
- Product
- Newsletter Plugin for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comacymailing.com
Mar 30, 2023AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrCVE-2023-28731 · Other software · AcyMailing · reported by vulnerability@ncsc.chCritical 9.8
AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
- Product
- Newsletter Plugin for Joomla in the Enterprise version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacymailing.combugbounty.ch
Feb 27, 2023Arigato Autoresponder and Newsletter: Does not sanitize and escape some of its settingsCVE-2023-0543 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Arigato Autoresponder and Newsletter
- Fixed in
- 2.1.7.2
- What to do
- Update Arigato Autoresponder and Newsletter to 2.1.7.2 or newer.
Feb 13, 2023Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.CVE-2022-41134 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.
- Fixed in
- 1.0.16
- What to do
- Update the plugin to 1.0.16 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 22, 2022An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4.CVE-2022-41654 · Other software · Ghost Foundation · reported by talos-cna@cisco.comMedium 4.3
An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtalosintelligence.com
Dec 14, 2022An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.CVE-2022-47411 · Other software · FP Newsletter Project · reported by MITRECritical 9.1
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations.
- Product
- FP Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.CVE-2022-47410 · Other software · FP Newsletter Project · reported by MITRECritical 9.1
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.
- Product
- FP Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.CVE-2022-47409 · Other software · FP Newsletter Project · reported by MITRECritical 9.1
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Attackers can unsubscribe everyone via a series of modified subscription UIDs in deleteAction operations.
- Product
- FP Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.CVE-2022-47408 · Other software · FP Newsletter Project · reported by MITRECritical 9.1
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. There is a CAPTCHA bypass that can lead to subscribing many people.
- Product
- FP Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2022OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newlCVE-2022-41403 · Other software · Newsletter Subscribe (popup + Regular Module) Project · reported by MITRECritical 9.8
OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newletter_custom_popup/newsletter.
- Product
- Newsletter Subscribe (popup + Regular Module)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Aug 22, 2022Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami: Does not have authorisation and CSRF checks in one of its AJAX actionCVE-2022-2389 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations
- Product
- Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami
- Fixed in
- 2.1.2
- What to do
- Update Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami to 2.1.2 or newer.
Jul 5, 2022Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.CVE-2022-31856 · Other software · Newsletter Module Project · reported by MITRECritical 9.8
Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.
- Product
- Newsletter Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 20, 2022Newsletter: Does not escape and sanitise the preheader_text settingCVE-2022-1889 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed
- Product
- Newsletter
- Fixed in
- 7.4.6
- What to do
- Update Newsletter to 7.4.6 or newer.
Jun 13, 2022Newsletter: Does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pagesCVE-2022-1756 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
- Product
- Newsletter
- Fixed in
- 7.4.5
- What to do
- Update Newsletter to 7.4.5 or newer.
Mar 7, 2022Email Subscribers & Newsletters: Does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` actionCVE-2022-0439 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
- Product
- Email Subscribers & Newsletters
- Fixed in
- 5.3.2
- What to do
- Update Email Subscribers & Newsletters to 5.3.2 or newer.
Feb 14, 2022WordPress Newsletter: Does not validate the to parameter before redirecting the user to its given valueCVE-2021-25033 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
- Product
- WordPress Newsletter
- Fixed in
- 1.6.5
- What to do
- Update WordPress Newsletter to 1.6.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the lang and pid parameter before outputting them back in attributesCVE-2021-24874 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.31
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.31 or newer.
Jan 24, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the sib-statistics-date parameter before outputting it back in an attributeCVE-2021-24923 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.25
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.25 or newer.
Aug 16, 2021Simple Popup Newsletter: Reflected Cross-Site ScriptingCVE-2021-34658 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.7.
- Product
- Simple Popup Newsletter
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Simple Popup Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 13, 2021The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.CVE-2021-38302 · Other software · Newsletter Project · reported by MITRECritical 9.8
The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.
- Product
- Newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2021Nifty Newsletters: Cross-Site Request ForgeryCVE-2021-34634 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.23.
- Product
- Nifty Newsletters
- Affected
- up to 4.0.23
- What to do
- Affects up to 4.0.23. Update Nifty Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 21, 2021Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacCVE-2021-20743 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 allows a remote attacker to inject an arbitrary script by leading a user to a specially crafted page and to perform a specific operation.
- Product
- EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2021The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or esCVE-2021-24345 · WordPress plugins & themes · reported by WPScanMedium 6.6
The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.
- Product
- Sendit WP Newsletter
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Sendit WP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Mar 31, 2021ps_emailsubscription is a newsletter subscription module for the PrestaShop platform.CVE-2021-21418 · Websites & servers · PrestaShop · reported by GitHubMedium 4.6
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
- Product
- ps_emailsubscription
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victimCVE-2020-35933 · WordPress plugins & themes · reported by MITREMedium 6.5
A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.
- Product
- A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter
- Fixed in
- 6.8.2
- What to do
- Update A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 31, 2020Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers)CVE-2020-35932 · WordPress plugins & themes · reported by MITREHigh 7.5
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.
- Product
- Insecure Deserialization in the Newsletter
- Fixed in
- 6.8.2
- What to do
- Update Insecure Deserialization in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Nov 25, 2020osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.CVE-2020-29070 · Websites & servers · Oscommerce · reported by MITREMedium 4.8
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
- Product
- Oscommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.oscommerce.comgithub.com
Sep 10, 2020Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticCVE-2020-5780 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.3
Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing.
- Fixed in
- 4.5.6
- What to do
- Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jul 17, 2020Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 alloCVE-2020-5768 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 4.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker to determine the value of database fields.
- Affected
- 4.4.8 to 4.4.8
- What to do
- Affects 4.4.8 to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Jul 17, 2020Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legCVE-2020-5767 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.5
Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link.
- Affected
- 4.4.8 to 4.4.8
- What to do
- Affects 4.4.8 to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
May 13, 2020The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.CVE-2020-12700 · Other software · DKD · reported by MITREMedium 4.3
The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
- Product
- Direct Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.