Contrid vulnerabilities

Products

• Newsletters 12
• Slideshow Gallery Lite 4

Newest

• contrid newsletters Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter CVE-2026-101325 5.3 MediumOctober 31, 2026
• contrid newsletters Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter CVE-2026-75908 4.3 MediumAugust 25, 2026
• contrid newsletters Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute CVE-2026-12939 6.4 MediumJuly 29, 2026
• contrid newsletters Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute CVE-2026-12938 6.4 MediumJuly 29, 2026
• contrid slideshow gallery lite Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute CVE-2026-2021 6.4 MediumJune 18, 2026
• contrid newsletters Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter CVE-2026-3018 7.5 HighJune 10, 2026
• contrid newsletters Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion CVE-2025-4857 7.2 HighMay 31, 2025
• contrid newsletters Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter CVE-2025-3107 6.5 MediumMay 13, 2025
• contrid newsletters Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting CVE-2025-2009 7.2 HighMarch 26, 2025
• contrid newsletters Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter CVE-2024-13739 6.1 MediumMarch 22, 2025
• contrid newsletters Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode CVE-2024-10181 6.4 MediumOctober 29, 2024
• contrid newsletters Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation CVE-2024-8247 8.8 HighSeptember 6, 2024
• contrid newsletters Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure CVE-2024-7411 5.3 MediumAugust 15, 2024
• contrid slideshow gallery lite Slideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injection CVE-2024-5543 8.1 HighJune 12, 2024
• contrid slideshow gallery lite, tribulant slideshow gallery +1 more WordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to SQL Injection CVE-2023-28491 6.7 MediumDecember 20, 2023
• contrid slideshow gallery lite, tribulant slideshow gallery +1 more WordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-28497 5.4 MediumNovember 12, 2023