Newsletters

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Newsletters

Information

Software Type Plugin
Software Slug newsletters-lite (view on wordpress.org)
Software Status Active
Software Author contrid
Software Website tribulant.com
Software Downloads 306,009
Software Active Installs 2,000
Software Record Last Updated July 13, 2026

Showing 1-20 of 29 Vulnerabilities

Submit a Vulnerability
Newsletters <= 4.13 - Missing Authorization
4.3
CVE-2026-57645
Jun 26, 2026
Researcher: Prodigysec
Newsletters <= 4.13 - Missing Authorization
5.3
CVE-2026-54840
Jun 18, 2026
Researcher: HieuPenguinnn
Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
7.5
CVE-2026-3018
Jun 9, 2026
Researcher: wesley (wcraft)
Newsletters <= 4.11 - Unauthenticated PHP Object Injection
8.1
CVE-2025-67911
Dec 31, 2025
Researcher: Skalucy
Newsletters <= 4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-69020
Dec 28, 2025
Researcher: Muhammad Yudha - DJ
Newsletters <= 4.10 - Unauthenticated Local File Inclusion
8.1
CVE-2025-54034
Jul 29, 2025
Researcher: Nguyen Xuan Chien
Newsletters <= 4.10 - Cross-Site Request Forgery
4.3
CVE-2025-54035
Jul 16, 2025
Researcher: Nguyen Xuan Chien
Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion
7.2
CVE-2025-4857
May 30, 2025
Researcher: m3ssap0
Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter
6.5
CVE-2025-3107
May 12, 2025
Researcher: Peter Thaleikis
Newsletters <= 4.9.9.7 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2025-30921
Mar 27, 2025
Researcher: Webula
Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-2009
Mar 25, 2025
Researcher: m3ssap0
Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter
6.1
CVE-2024-13739
Mar 21, 2025
Researcher: Arkadiusz Hydzik
Newsletters <= 4.9.9.6 - Reflected Cross-Site Scripting
6.1
CVE-2025-24599
Dec 26, 2024
Researcher: Le Ngoc Anh
Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode
6.4
CVE-2024-10181
Oct 28, 2024
Researcher: Peter Thaleikis
Newsletters <= 4.9.9.1 - Reflected Cross-Site Scripting
6.1
CVE-2024-47346
Sep 27, 2024
Researcher: Le Ngoc Anh
Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation
8.8
CVE-2024-8247
Sep 5, 2024
Researcher: rajesh patil
Newsletters <= 4.9.8 - Reflected Cross-Site Scripting
6.1
CVE-2024-43279
Aug 16, 2024
Researcher: LVT-tholv2k
Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure
5.3
CVE-2024-7411
Aug 14, 2024
Researcher: stealthcopter
Newsletters <= 4.9.7 - Cross-Site Request Forgery
4.3
CVE-2024-37227
Jun 21, 2024
Researcher: Peng Zhou
Newsletters <= 4.9.5 - Reflected Cross-Site Scripting
6.1
CVE-2024-35718
Jun 6, 2024
Researcher: beluga
Title Status CVE ID CVSS Researchers Date
Newsletters <= 4.13 - Missing Authorization Patched CVE-2026-57645 4.3 Prodigysec June 26, 2026
Newsletters <= 4.13 - Missing Authorization Patched CVE-2026-54840 5.3 HieuPenguinnn June 18, 2026
Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter Patched CVE-2026-3018 7.5 wesley (wcraft) June 9, 2026
Newsletters <= 4.11 - Unauthenticated PHP Object Injection Patched CVE-2025-67911 8.1 Skalucy December 31, 2025
Newsletters <= 4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-69020 6.4 Muhammad Yudha - DJ December 28, 2025
Newsletters <= 4.10 - Unauthenticated Local File Inclusion Patched CVE-2025-54034 8.1 Nguyen Xuan Chien July 29, 2025
Newsletters <= 4.10 - Cross-Site Request Forgery Patched CVE-2025-54035 4.3 Nguyen Xuan Chien July 16, 2025
Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion Patched CVE-2025-4857 7.2 m3ssap0 May 30, 2025
Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter Patched CVE-2025-3107 6.5 Peter Thaleikis May 12, 2025
Newsletters <= 4.9.9.7 - Authenticated (Administrator+) SQL Injection Patched CVE-2025-30921 4.9 Webula March 27, 2025
Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2025-2009 7.2 m3ssap0 March 25, 2025
Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter Patched CVE-2024-13739 6.1 Arkadiusz Hydzik March 21, 2025
Newsletters <= 4.9.9.6 - Reflected Cross-Site Scripting Patched CVE-2025-24599 6.1 Le Ngoc Anh December 26, 2024
Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode Patched CVE-2024-10181 6.4 Peter Thaleikis October 28, 2024
Newsletters <= 4.9.9.1 - Reflected Cross-Site Scripting Patched CVE-2024-47346 6.1 Le Ngoc Anh September 27, 2024
Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation Patched CVE-2024-8247 8.8 rajesh patil September 5, 2024
Newsletters <= 4.9.8 - Reflected Cross-Site Scripting Patched CVE-2024-43279 6.1 LVT-tholv2k August 16, 2024
Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure Patched CVE-2024-7411 5.3 stealthcopter August 14, 2024
Newsletters <= 4.9.7 - Cross-Site Request Forgery Patched CVE-2024-37227 4.3 Peng Zhou June 21, 2024
Newsletters <= 4.9.5 - Reflected Cross-Site Scripting Patched CVE-2024-35718 6.1 beluga June 6, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation