Skip to contentTribulant Software Newsletters vulnerabilities
- tribulant software newslettersWordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerabilityCVE-2026-1242658.5 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.18.2 - PHP Object Injection vulnerabilityCVE-2026-1195128.8 High
- contrid newslettersNewsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User MetaCVE-2026-1220636.5 Medium
- contrid newslettersNewsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' ParameterCVE-2026-1013255.3 Medium
- tribulant software newslettersWordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-1168639.6 Critical
- tribulant software newslettersWordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerabilityCVE-2026-940759.8 Critical
- tribulant software newslettersWordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerabilityCVE-2026-1114029.3 Critical
- tribulant software newslettersNewsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDORCVE-2026-162646.5 Medium
- tribulant software newslettersWordPress Newsletters plugin <= 4.18 - SQL Injection vulnerabilityCVE-2026-666197.6 High
- tribulant software newslettersNewsletters < 4.17 - Arbitrary Plugin Option Update via CSRFCVE-2026-175225.4 Medium
- tribulant software newslettersNewsletters < 4.17 - Unauthenticated API Access via Predictable API KeyCVE-2026-175204.8 Medium
- contrid newslettersNewsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST ParameterCVE-2026-759084.3 Medium
- tribulant software newslettersNewsletters < 4.16 - Unauthenticated API Authentication Bypass via Type JugglingCVE-2026-162694.8 Medium
- tribulant software newslettersNewsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form FieldCVE-2026-162678.1 High
- tribulant software newslettersNewsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce HandlerCVE-2026-162688.2 High
- contrid newslettersNewsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode AttributeCVE-2026-129396.4 Medium
- contrid newslettersNewsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode AttributeCVE-2026-129386.4 Medium
- tribulant software newslettersNewsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom FieldCVE-2026-125838.1 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-573947.1 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerabilityCVE-2026-576458.1 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerabilityCVE-2026-548407.3 High
- contrid newslettersNewsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id ParameterCVE-2026-30187.5 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerabilityCVE-2025-679119.8 Critical
- tribulant software newslettersWordPress Newsletters plugin <= 4.12 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-690206.5 Medium
- tribulant software newslettersWordPress Newsletters plugin <= 4.10 - Local File Inclusion vulnerabilityCVE-2025-540347.5 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) VulnerabilityCVE-2025-540354.3 Medium
- contrid newslettersNewsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File InclusionCVE-2025-48577.2 High
- contrid newslettersNewsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby ParameterCVE-2025-31076.5 Medium
- tribulant software newslettersWordPress Newsletters plugin <= 4.9.9.7 - SQL Injection vulnerabilityCVE-2025-30921Public exploit7.6 High
- contrid newslettersNewsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site ScriptingCVE-2025-20097.2 High
- contrid newslettersNewsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To ParameterCVE-2024-137396.1 Medium
- tribulant software newslettersWordPress Newsletters plugin <= 4.9.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2025-245997.1 High
- contrid newslettersNewsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video ShortcodeCVE-2024-101816.4 Medium
- tribulant software newslettersWordPress Newsletters plugin <= 4.9.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2024-473467.1 High
- contrid newslettersNewsletters <= 4.9.9.2 - Authenticated Privilege EscalationCVE-2024-82478.8 High
- tribulant newslettersWordPress Newsletters plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-432797.1 High
- contrid newslettersNewsletters <= 4.9.9 - Unauthenticated Full Path DisclosureCVE-2024-74115.3 Medium
- tribulant newslettersWordPress Newsletters plugin <= 4.9.7 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-372274.3 Medium
- tribulant newslettersWordPress Newsletters plugin <= 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2024-357187.1 High
- tribulant newslettersWordPress Newsletters plugin <= 4.9.5 - Arbitrary File Upload vulnerabilityCVE-2024-329549.1 Critical
- tribulant newslettersNewsletter Lite < 4.9.3 - Admin+ Command InjectionCVE-2023-47977.2 High
- tribulant newslettersWordPress Newsletters Plugin <= 4.8.8 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-304785.4 Medium