VendorsThenewsletterpluginnewsletterany version
Vulnerabilities

Thenewsletterplugin Newsletter any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

10CVEs
CVE-2020-35933
A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.
Published 2021-01-01 · Modified
6.5EPSS 0.009
CVE-2023-4772
Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published 2023-09-07 · Modified
6.4EPSS 0.005
CVE-2024-5317
Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1
Published 2024-06-05 · Modified
6.4EPSS 0.003
CVE-2022-1756
Newsletter < 7.4.5 - Reflected Cross-Site Scripting
Published 2022-06-13 · Modified
6.1EPSS 0.019
CVE-2023-27922
Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary script.
Published 2023-05-23 · Modified
6.1EPSS 0.012
CVE-2022-1889
Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting
Published 2022-06-20 · Modified
4.8EPSS 0.006
CVE-2025-3583
Newsletter < 8.7.1 - Admin+ Stored XSS
Published 2025-05-05 · Analyzed
4.8EPSS 0.003
CVE-2025-3581
Newsletter < 8.8.5 - Admin+ Stored XSS via Widget
Published 2025-06-09 · Analyzed
4.8EPSS 0.003
CVE-2025-3582
Newsletter < 8.8.5 - Admin+ Stored XSS via Form
Published 2025-06-09 · Analyzed
4.8EPSS 0.003
CVE-2025-3584
Newsletter < 8.8.2 - Admin+ Stored XSS via Subscription
Published 2025-06-03 · Analyzed
4.8EPSS 0.002