Newsletter

This hub aggregates every CVE we track for Newsletter, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Newsletter.

• CVE-2025-67999WordPress Newsletter plugin <= 9.0.9 - SQL Injection vulnerability7.6Dec 16, 2025
• CVE-2025-3582Newsletter < 8.8.5 - Admin+ Stored XSS via Form4.8Jun 9, 2025
• CVE-2025-3581Newsletter < 8.8.5 - Admin+ Stored XSS via Widget4.8Jun 9, 2025
• CVE-2025-3584Newsletter < 8.8.2 - Admin+ Stored XSS via Subscription4.8Jun 3, 2025
• CVE-2025-3583Newsletter < 8.7.1 - Admin+ Stored XSS4.8May 5, 2025
• CVE-2024-5674Newsletter - API v1 and v2 addon for Newsletter <= 2.4.5 - Missing Authorization to Email Subscribers Management6.5Jun 12, 2024
• CVE-2024-5317Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np16.4Jun 5, 2024
• CVE-2024-30522WordPress Newsletter plugin <= 8.2.0 - IP Blacklist Bypass vulnerability5.3May 17, 2024
• CVE-2024-31434WordPress Newsletter plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) vulnerability5.4Apr 15, 2024
• CVE-2023-4772Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4Sep 7, 2023
• CVE-2023-27922Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary script.6.1May 23, 2023
• CVE-2022-1889Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting4.8Jun 20, 2022
• CVE-2022-1756Newsletter < 7.4.5 - Reflected Cross-Site Scripting6.1Jun 13, 2022
• CVE-2021-38302The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.9.8Aug 13, 2021
• CVE-2020-35933A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX r...6.5Jan 1, 2021