Newsletter – Send awesome emails from WordPress

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Newsletter – Send awesome emails from WordPress

Information

Software Type Plugin
Software Slug newsletter (view on wordpress.org)
Software Status Active
Software Author satollo
Software Website www.thenewsletterplugin.com
Software Downloads 36,173,605
Software Active Installs 200,000
Software Record Last Updated October 16, 2026

Showing 1-20 of 24 Vulnerabilities

Submit a Vulnerability
Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
7.2
CVE-2026-96566
Oct 1, 2026
Researcher: crow
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
5.3
CVE-2026-92537
Sep 30, 2026
Researcher: Swayam Bhageria
Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
6.1
CVE-2026-90981
Sep 17, 2026
Researcher: Yuto Hyakumoto
Newsletter – Send awesome emails from WordPress <= 9.3.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-66596
Aug 19, 2026
Researcher: daroo
Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription
4.3
CVE-2026-1051
Jan 19, 2026
Researchers: Sergej Ljubojevic, Boris Bogosavac
Newsletter <= 9.0.9 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2025-67999
Dec 15, 2025
Researcher: Doan Dinh Van (d52v)
Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-3582
May 19, 2025
Researcher: Dmitrii Ignatyev
Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
5.5
CVE-2025-3581
May 19, 2025
Researcher: Dmitrii Ignatyev
Newsletter <= 8.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-3584
May 13, 2025
Researcher: Dmitrii Ignatyev
Newsletter <= 8.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-3583
Apr 14, 2025
Researcher: Dmitrii Ignatyev
Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1
6.4
CVE-2024-5317
Jun 4, 2024
Researcher: Arkadiusz Hydzik
Newsletter <= 8.0.6 - Cross-Site Request Forgery
4.3
CVE-2024-31434
Apr 10, 2024
Researcher: Dhabaleshwar Das
Newsletter <= 8.2.0 - IP Spoofing
5.3
CVE-2024-30522
Mar 28, 2024
Researcher: Kévin Mosbahi (Mika)
Newsletter <= 8.0.6 - Cross-Site Request Forgery
4.7
CVE ID Unknown
Jan 10, 2024
Researchers:
Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2023-4772
Aug 17, 2023
Researcher: István Márton
Newsletter <= 7.6.8 - Reflected Cross-Site Scripting
4.7
CVE-2023-27922
Mar 27, 2023
Researcher: Gen Sato
Newsletter <= 7.4.5 - Authenticated (Admin+) Stored Cross-Site Scripting
5.5
CVE-2022-1889
May 30, 2022
Researcher: PHYO WIN SHEIN
Newsletter – Send awesome emails from WordPress <= 7.4.4 - Reflected Cross-Site Scripting
6.1
CVE-2022-1756
May 23, 2022
Researcher: PHYO WIN SHEIN
Newsletter <= 6.8.1 - Reflected Cross-Site Scripting
6.5
CVE-2020-35933
Aug 3, 2020
Researcher: Ram
Newsletter <= 6.8.1 - Authenticated PHP Object Injection
7.5
CVE-2020-35932
Aug 2, 2020
Researcher: Ram
Title Status CVE ID CVSS Researchers Date
Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter Patched CVE-2026-96566 7.2 crow October 1, 2026
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure) Patched CVE-2026-92537 5.3 Swayam Bhageria September 30, 2026
Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter Patched CVE-2026-90981 6.1 Yuto Hyakumoto September 17, 2026
Newsletter – Send awesome emails from WordPress <= 9.3.3 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-66596 7.2 daroo August 19, 2026
Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription Patched CVE-2026-1051 4.3 Sergej Ljubojevic, Boris Bogosavac January 19, 2026
Newsletter <= 9.0.9 - Authenticated (Administrator+) SQL Injection Patched CVE-2025-67999 4.9 Doan Dinh Van (d52v) December 15, 2025
Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2025-3582 4.4 Dmitrii Ignatyev May 19, 2025
Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2025-3581 5.5 Dmitrii Ignatyev May 19, 2025
Newsletter <= 8.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2025-3584 4.4 Dmitrii Ignatyev May 13, 2025
Newsletter <= 8.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2025-3583 4.4 Dmitrii Ignatyev April 14, 2025
Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1 Patched CVE-2024-5317 6.4 Arkadiusz Hydzik June 4, 2024
Newsletter <= 8.0.6 - Cross-Site Request Forgery Patched CVE-2024-31434 4.3 Dhabaleshwar Das April 10, 2024
Newsletter <= 8.2.0 - IP Spoofing Patched CVE-2024-30522 5.3 Kévin Mosbahi (Mika) March 28, 2024
Newsletter <= 8.0.6 - Cross-Site Request Forgery Patched 4.7 January 10, 2024
Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2023-4772 6.4 István Márton August 17, 2023
Newsletter <= 7.6.8 - Reflected Cross-Site Scripting Patched CVE-2023-27922 4.7 Gen Sato March 27, 2023
Newsletter <= 7.4.5 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2022-1889 5.5 PHYO WIN SHEIN May 30, 2022
Newsletter – Send awesome emails from WordPress <= 7.4.4 - Reflected Cross-Site Scripting Patched CVE-2022-1756 6.1 PHYO WIN SHEIN May 23, 2022
Newsletter <= 6.8.1 - Reflected Cross-Site Scripting Patched CVE-2020-35933 6.5 Ram August 3, 2020
Newsletter <= 6.8.1 - Authenticated PHP Object Injection Patched CVE-2020-35932 7.5 Ram August 2, 2020

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation