Newsletters vulnerabilities
We track 4 vulnerabilities in Newsletters products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 8, 2026.
Latest Newsletters vulnerabilities
- 8.1 High severity
Newsletters: Deserialization of Untrusted Data
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.
- 8.2 High severity
Newsletters: Server-Side Request Forgery
The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or exter
- 8.1 High severity
Newsletters: Deserialization of Untrusted Data
The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newslett
- 7.2 High severity
Newsletters: Improper Neutralization of Special Elements used in a Command
The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.