Skip to contentContrid Newsletters vulnerabilities
- contrid newslettersNewsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' ParameterCVE-2026-1013255.3 Medium
- contrid newslettersNewsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST ParameterCVE-2026-759084.3 Medium
- contrid newslettersNewsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode AttributeCVE-2026-129396.4 Medium
- contrid newslettersNewsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode AttributeCVE-2026-129386.4 Medium
- contrid newslettersNewsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id ParameterCVE-2026-30187.5 High
- contrid newslettersNewsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File InclusionCVE-2025-48577.2 High
- contrid newslettersNewsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby ParameterCVE-2025-31076.5 Medium
- contrid newslettersNewsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site ScriptingCVE-2025-20097.2 High
- contrid newslettersNewsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To ParameterCVE-2024-137396.1 Medium
- contrid newslettersNewsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video ShortcodeCVE-2024-101816.4 Medium
- contrid newslettersNewsletters <= 4.9.9.2 - Authenticated Privilege EscalationCVE-2024-82478.8 High
- contrid newslettersNewsletters <= 4.9.9 - Unauthenticated Full Path DisclosureCVE-2024-74115.3 Medium