WordPress plugin
Newsletters security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical2
- High14
- Medium30
- Low0
All Newsletters vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.1 | Unauthenticated PHP Object Injection ≤4.18.1Update to 4.18.2 | CVE-2026-94075 | |
| High7.5 | Unauthenticated SQL Injection ≤4.18.1Update to 4.18.2 | CVE-2026-111402 | |
| High8.1 | Unauthenticated PHP Object Injection ≤4.15Update to 4.16 | CVE-2026-16267 | |
| High7.3 | Unauthenticated API Authorization Bypass via Type Juggling ≤4.15Update to 4.16 | CVE-2026-16269 | |
| High7.2 | Unauthenticated Server-Side Request Forgery ≤4.15Update to 4.16 | CVE-2026-16268 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.14Update to 4.15 | CVE-2026-57394 | |
| High8.1 | Unauthenticated PHP Object Injection ≤4.14Update to 4.15 | CVE-2026-12583 | |
| High7.5 | Unauthenticated SQL Injection via wpmlsubscriber_id Parameter ≤4.13Update to 4.14 | CVE-2026-3018 | |
| High8.1 | Unauthenticated PHP Object Injection ≤4.11Update to 4.12 | CVE-2025-67911 | |
| High8.1 | Unauthenticated Local File Inclusion ≤4.10Update to 4.11 | CVE-2025-54034 | |
| High7.2 | Authenticated (Administrator+) Local File Inclusion ≤4.9.9.9Update to 4.10 | CVE-2025-4857 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.9.9.7Update to 4.9.9.8 | CVE-2025-2009 | |
| High8.8 | Authenticated Privilege Escalation ≤4.9.9.2Update to 4.9.9.3 | CVE-2024-8247 | |
| Critical9.1 | Authenticated (Admin+) Arbitrary File Upload ≤4.9.5Update to 4.9.6 | CVE-2024-32954 | |
| High8.8 | Directory Traversal <4.6.19Update to 4.6.19 | CVE-2019-14788 | |
| Critical9.8 | Object Injection <4.6.8.6Update to 4.6.8.6 | CVE-2018-20987 |
- High8.1Unauthenticated PHP Object Injection
≤4.18.1Update to 4.18.2
- High7.5Unauthenticated SQL Injection
≤4.18.1Update to 4.18.2
- High8.1Unauthenticated PHP Object Injection
≤4.15Update to 4.16
- High7.3Unauthenticated API Authorization Bypass via Type Juggling
≤4.15Update to 4.16
- High7.2Unauthenticated Server-Side Request Forgery
≤4.15Update to 4.16
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.14Update to 4.15
- High8.1Unauthenticated PHP Object Injection
≤4.14Update to 4.15
- High7.5Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
≤4.13Update to 4.14
- High8.1Unauthenticated PHP Object Injection
≤4.11Update to 4.12
- High8.1Unauthenticated Local File Inclusion
≤4.10Update to 4.11
- High7.2Authenticated (Administrator+) Local File Inclusion
≤4.9.9.9Update to 4.10
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.9.9.7Update to 4.9.9.8
- High8.8Authenticated Privilege Escalation
≤4.9.9.2Update to 4.9.9.3
- Critical9.1Authenticated (Admin+) Arbitrary File Upload
≤4.9.5Update to 4.9.6
- High8.8Directory Traversal
<4.6.19Update to 4.6.19
- Critical9.8Object Injection
<4.6.8.6Update to 4.6.8.6
Newsletters: common questions
Does Newsletters have known vulnerabilities?
Yes. VulnCrest Radar lists 46 known vulnerabilities in Newsletters: 2 critical, 14 high, 30 medium. At least one is not fixed in the latest version.
How do I check which version of Newsletters I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Newsletters vulnerability?
CVE-2026-122063, published Nov 12, 2026: Newsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta. Severity: Medium (CVSS 6.5).
Is any Newsletters vulnerability listed in CISA KEV?
No. None of the known Newsletters vulnerabilities is currently listed in the CISA KEV catalog.