Email Newsletter Vulnerabilities

The Email Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search’ parameter in versions up to, and including, 20.13.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that ex...

CVSS:

7.1

Affected:

up to 20.13.6

Fixed in:

20.13.7

Disclosed:

Nov 24, 2015

The Email Newsletter plugin for WordPress is vulnerable to generic SQL Injection in versions up to, and including, 20.15 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQ...

CVSS:

9.8

Affected:

up to 20.15

Fix:

No patched version reported

Disclosed:

Jun 25, 2015

CVE-2015-9334 on NVD →

The Email Newsletter for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 8.0. This made it possible for unauthenticated attackers to extract sensitive data such as user emails.

CVSS:

7.5

Affected:

up to 8.0

Fixed in:

9.0

Disclosed:

Aug 1, 2014