Eelv Newsletter Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound EELV Newsletter allows Reflected XSS. This issue affects EELV Newsletter: from n/a through 4.8.2.

Affected:

up to 4.8.2

Fix:

No patched version reported

Disclosed:

Jan 22, 2025

CVE-2025-23602 on NVD →

The EELV Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 4.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successf...

CVSS:

6.1

Affected:

up to 4.8.2

Fix:

No patched version reported

Disclosed:

Jan 16, 2025

CVE-2025-23602 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Bastien Ho EELV Newsletter allows Cross Site Request Forgery.This issue affects EELV Newsletter: from n/a through 4.8.2.

Affected:

up to 4.8.2

Fix:

No patched version reported

Disclosed:

Dec 16, 2024

CVE-2024-54430 on NVD →

The EELV Newsletter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can t...

CVSS:

6.1

Affected:

up to 4.8.2

Fix:

No patched version reported

Disclosed:

Dec 12, 2024

CVE-2024-54430 on NVD →

[en] A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the function style_newsletter of the file lettreinfo.php. The manipulation of the argument email leads to cross site scripting. The attack may be launched remotely. The name of the patc...

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Jun 4, 2023

CVE-2013-10028 on NVD →

[en] The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.

Affected:

up to 4.6.1

Fixed in:

4.6.1

Disclosed:

Aug 20, 2019

CVE-2017-18522 on NVD →

[en] The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.

Affected:

up to 4.6.1

Fixed in:

4.6.1

Disclosed:

Aug 20, 2019

CVE-2017-18523 on NVD →

The EELV Newsletter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.6.0. This is due to missing or incorrect nonce validation in the 'eelv-newsletter/trunk/lettreinfo.php' file. This makes it possible for unauthenticated attackers to gain otherwise restricted access...

CVSS:

8.8

Affected:

up to 4.6.0

Fixed in:

4.6.1

Disclosed:

May 18, 2017

CVE-2017-18523 on NVD →

The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.

CVSS:

6.1

Affected:

up to 4.6.1

Fixed in:

4.6.1

Disclosed:

May 18, 2017

CVE-2017-18522 on NVD →

This plugin is prone to a cross site scripting vulnerability in lettreinfo.php. Update the plugin.

Affected:

up to 3.5.0

Fixed in:

3.5.0

Disclosed:

May 15, 2015

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

May 15, 2015

The EELV Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

CVSS:

6.1

Affected:

up to 3.3.0

Fixed in:

3.3.1

Disclosed:

Apr 17, 2013

CVE-2013-10028 on NVD →

The EELV Newsletter WordPress plugin was affected by a Cross-Site Scripting security vulnerability.

Affected:

up to 3.3.1

Fixed in:

3.3.1

The EELV Newsletter WordPress plugin was affected by a lettreinfo.php Unspecified XSS security vulnerability.

Affected:

up to 3.5.0

Fixed in:

3.5.0