Blossomthemes Email Newsletter Vulnerabilities

[en] Missing Authorization vulnerability in blossomthemes BlossomThemes Email Newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through 2.2.4.

Affected:

up to 2.2.5

Fixed in:

2.2.5

Disclosed:

Dec 9, 2024

CVE-2023-47849 on NVD →

[en] Server-Side Request Forgery (SSRF) vulnerability in Blossom Themes BlossomThemes Email Newsletter.This issue affects BlossomThemes Email Newsletter: from n/a through 2.2.6.

Affected:

up to 2.2.7

Fixed in:

2.2.7

Disclosed:

Jun 26, 2024

CVE-2024-37098 on NVD →

The BlossomThemes Email Newsletter plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web applicatio...

CVSS:

5.5

Affected:

up to 2.2.6

Fixed in:

2.2.7

Disclosed:

Jun 20, 2024

CVE-2024-37098 on NVD →

The BlossomThemes Email Newsletter plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bten_get_mailing_list function in versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to obtain a mailing list.

CVSS:

5.3

Affected:

up to 2.2.4

Fixed in:

2.2.5

Disclosed:

Nov 20, 2023

CVE-2023-47849 on NVD →