VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Newsletters security & vulnerabilities

newsletters-lite— active installsLast vulnerability Nov 12, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
46Known vulnerabilities
  • Critical2
  • High14
  • Medium30
  • Low0
Vulnerabilities per year
2017: 2 vulnerabilities2172018: 1 vulnerability1182019: 2 vulnerabilities2192023: 2 vulnerabilities2232024: 10 vulnerabilities10242025: 9 vulnerabilities9252026: 20 vulnerabilities2026

All Newsletters vulnerabilities

Newsletters vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.5Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta
≤4.18.2Update to 4.18.3
CVE-2026-122063
Medium5.3Authenticated (Subscriber+) SQL Injection via 'id' Parameter
≤4.18.1Update to 4.18.2
CVE-2026-101325
Medium4.3Cross-Site Request Forgery
≤4.18.2No patch available
CVE-2026-116863
High8.1Unauthenticated PHP Object Injection
≤4.18.1Update to 4.18.2
CVE-2026-94075
High7.5Unauthenticated SQL Injection
≤4.18.1Update to 4.18.2
CVE-2026-111402
Medium5.3Unauthenticated Insecure Direct Object Reference
≤4.18.0Update to 4.18.1
CVE-2026-16264
Medium4.9Authenticated (Administrator+) SQL Injection
≤4.18Update to 4.18.1
CVE-2026-66619
Medium4.3Cross-Site Request Forgery
<4.17Update to 4.17
CVE-2026-17522
Medium5.3Insufficient Authorization
<4.17Update to 4.17
CVE-2026-17520
Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter
≤4.17Update to 4.18
CVE-2026-75908
High8.1Unauthenticated PHP Object Injection
≤4.15Update to 4.16
CVE-2026-16267
High7.3Unauthenticated API Authorization Bypass via Type Juggling
≤4.15Update to 4.16
CVE-2026-16269
High7.2Unauthenticated Server-Side Request Forgery
≤4.15Update to 4.16
CVE-2026-16268
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
≤4.15Update to 4.16
CVE-2026-12939
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
≤4.15Update to 4.16
CVE-2026-12938
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.14Update to 4.15
CVE-2026-57394
Medium4.3Missing Authorization
≤4.13Update to 4.14
CVE-2026-57645
High8.1Unauthenticated PHP Object Injection
≤4.14Update to 4.15
CVE-2026-12583
Medium5.3Missing Authorization
≤4.13Update to 4.14
CVE-2026-54840
High7.5Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
≤4.13Update to 4.14
CVE-2026-3018
High8.1Unauthenticated PHP Object Injection
≤4.11Update to 4.12
CVE-2025-67911
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.12Update to 4.13
CVE-2025-69020
High8.1Unauthenticated Local File Inclusion
≤4.10Update to 4.11
CVE-2025-54034
Medium4.3Cross-Site Request Forgery
≤4.10Update to 4.11
CVE-2025-54035
High7.2Authenticated (Administrator+) Local File Inclusion
≤4.9.9.9Update to 4.10
CVE-2025-4857
Medium6.5Authenticated (Contributor+) SQL Injection orderby Parameter
≤4.9.9.8Update to 4.9.9.9
CVE-2025-3107
Medium4.9Authenticated (Administrator+) SQL Injection
≤4.9.9.7Update to 4.9.9.8
CVE-2025-30921
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.9.9.7Update to 4.9.9.8
CVE-2025-2009
Medium6.1Reflected Cross-Site Scripting via To Parameter
≤4.9.9.7Update to 4.9.9.8
CVE-2024-13739
Medium6.1Reflected Cross-Site Scripting
≤4.9.9.6Update to 4.9.9.7
CVE-2025-24599
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode
≤4.9.9.4Update to 4.9.9.5
CVE-2024-10181
Medium6.1Reflected Cross-Site Scripting
≤4.9.9.1Update to 4.9.9.2
CVE-2024-47346
High8.8Authenticated Privilege Escalation
≤4.9.9.2Update to 4.9.9.3
CVE-2024-8247
Medium6.1Reflected Cross-Site Scripting
≤4.9.8Update to 4.9.9
CVE-2024-43279
Medium5.3Unauthenticated Full Path Disclosure
≤4.9.9Update to 4.9.9.1
CVE-2024-7411
Medium4.3Cross-Site Request Forgery
≤4.9.7Update to 4.9.8
CVE-2024-37227
Medium6.1Reflected Cross-Site Scripting
≤4.9.5Update to 4.9.6
CVE-2024-35718
Critical9.1Authenticated (Admin+) Arbitrary File Upload
≤4.9.5Update to 4.9.6
CVE-2024-32954
Medium5.3Information Exposure via Log files
≤4.9.5Update to 4.9.6
CVE-2024-32953
Medium6.6Authenticated (Admin+) Command Injection
≤4.9.2Update to 4.9.3
CVE-2023-4797
Medium5.4Cross-Site Request Forgery
≤4.8.8Update to 4.8.9
CVE-2023-30478
High8.8Directory Traversal
<4.6.19Update to 4.6.19
CVE-2019-14788
Medium5.4Cross-Site Scripting via contentarea Parameter
<4.6.19Update to 4.6.19
CVE-2019-14787
Critical9.8Object Injection
<4.6.8.6Update to 4.6.8.6
CVE-2018-20987
Medium5.4Reflected Cross-Site Scripting
≤4.6.5.2Update to 4.6.5.3
—
Medium4.9Directory Traversal
≤4.6.4.2Update to 4.6.4.3
—

Newsletters: common questions

Does Newsletters have known vulnerabilities?

Yes. VulnCrest Radar lists 46 known vulnerabilities in Newsletters: 2 critical, 14 high, 30 medium. At least one is not fixed in the latest version.

How do I check which version of Newsletters I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Newsletters vulnerability?

CVE-2026-122063, published Nov 12, 2026: Newsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta. Severity: Medium (CVSS 6.5).

Is any Newsletters vulnerability listed in CISA KEV?

No. None of the known Newsletters vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?