Tribulant Software vulnerabilities

Products

• Newsletters 39

Newest

• contrid newsletters Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter CVE-2026-101325 5.3 MediumOctober 31, 2026
• tribulant software newsletters WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-116863 9.6 CriticalOctober 27, 2026
• tribulant software newsletters WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability CVE-2026-94075 9.8 CriticalOctober 24, 2026
• tribulant software newsletters WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability CVE-2026-111402 9.3 CriticalOctober 24, 2026
• tribulant software newsletters Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR CVE-2026-16264 6.5 MediumSeptember 23, 2026
• tribulant software newsletters WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability CVE-2026-66619 7.6 HighSeptember 17, 2026
• tribulant software newsletters Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF CVE-2026-17522 5.4 MediumAugust 29, 2026
• tribulant software newsletters Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key CVE-2026-17520 4.8 MediumAugust 29, 2026
• contrid newsletters Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter CVE-2026-75908 4.3 MediumAugust 25, 2026
• tribulant software newsletters Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling CVE-2026-16269 4.8 MediumAugust 8, 2026
• tribulant software newsletters Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field CVE-2026-16267 8.1 HighAugust 8, 2026
• tribulant software newsletters Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler CVE-2026-16268 8.2 HighAugust 6, 2026
• contrid newsletters Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute CVE-2026-12939 6.4 MediumJuly 29, 2026
• contrid newsletters Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute CVE-2026-12938 6.4 MediumJuly 29, 2026
• tribulant software newsletters Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field CVE-2026-12583 8.1 HighJuly 14, 2026
• tribulant software newsletters WordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerability CVE-2026-57394 7.1 HighJuly 13, 2026
• tribulant software newsletters WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability CVE-2026-57645 8.1 HighJune 26, 2026
• tribulant software newsletters WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability CVE-2026-54840 7.3 HighJune 26, 2026
• contrid newsletters Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter CVE-2026-3018 7.5 HighJune 10, 2026
• tribulant software newsletters WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability CVE-2025-67911 9.8 CriticalJanuary 8, 2026
• tribulant software newsletters WordPress Newsletters plugin <= 4.12 - Cross Site Scripting (XSS) vulnerability CVE-2025-69020 6.5 MediumDecember 30, 2025
• tribulant software newsletters WordPress Newsletters plugin <= 4.10 - Local File Inclusion vulnerability CVE-2025-54034 7.5 HighAugust 20, 2025
• tribulant software newsletters WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2025-54035 4.3 MediumJuly 16, 2025
• contrid newsletters Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion CVE-2025-4857 7.2 HighMay 31, 2025
• contrid newsletters Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter CVE-2025-3107 6.5 MediumMay 13, 2025
• tribulant software snow storm WordPress Snow Storm plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-30858 7.1 HighApril 3, 2025
• tribulant software newsletters WordPress Newsletters plugin <= 4.9.9.7 - SQL Injection vulnerability CVE-2025-30921 Public exploit 7.6 HighMarch 27, 2025
• contrid newsletters Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting CVE-2025-2009 7.2 HighMarch 26, 2025
• contrid newsletters Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter CVE-2024-13739 6.1 MediumMarch 22, 2025
• tribulant software gallery voting WordPress Tribulant Gallery Voting plugin <= 1.2.1 - CSRF to Stored XSS vulnerability CVE-2025-26931 7.1 HighFebruary 25, 2025
• tribulant software newsletters WordPress Newsletters plugin <= 4.9.9.6 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-24599 7.1 HighFebruary 4, 2025
• contrid newsletters Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode CVE-2024-10181 6.4 MediumOctober 29, 2024
• tribulant software newsletters WordPress Newsletters plugin <= 4.9.9.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-47346 7.1 HighOctober 6, 2024
• tribulant slideshow gallery WordPress Slideshow Gallery LITE plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability CVE-2024-47376 5.9 MediumOctober 5, 2024
• contrid newsletters Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation CVE-2024-8247 8.8 HighSeptember 6, 2024
• tribulant newsletters WordPress Newsletters plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability CVE-2024-43279 7.1 HighAugust 18, 2024
• contrid newsletters Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure CVE-2024-7411 5.3 MediumAugust 15, 2024
• tribulant newsletters WordPress Newsletters plugin <= 4.9.7 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-37227 4.3 MediumJune 21, 2024
• tribulant newsletters WordPress Newsletters plugin <= 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-35718 7.1 HighJune 8, 2024
• tribulant newsletters WordPress Newsletters plugin <= 4.9.5 - Arbitrary File Upload vulnerability CVE-2024-32954 9.1 CriticalApril 24, 2024
• tribulant newsletters Newsletter Lite < 4.9.3 - Admin+ Command Injection CVE-2023-4797 7.2 HighJanuary 16, 2024
• tribulant newsletters WordPress Newsletters Plugin <= 4.8.8 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-30478 5.4 MediumNovember 10, 2023