Letterpress Vulnerabilities

[en] The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers

Affected:

up to 1.2.2

Fix:

No patched version reported

Disclosed:

May 9, 2024

CVE-2024-3590 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeqx LetterPress allows Stored XSS.This issue affects LetterPress: from n/a through 1.2.1.

Affected:

up to 1.2.1

Fix:

No patched version reported

Disclosed:

May 8, 2024

CVE-2024-34568 on NVD →

The LetterPress – Elevate Your WordPress Site's E-Mail Campaigns and Marketing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the letterpress-subscribers page. This makes it possible for unauthent...

CVSS:

4.3

Affected:

up to 1.2.2

Fix:

No patched version reported

Disclosed:

Apr 18, 2024

CVE-2024-3590 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themeqx LetterPress plugin <= 1.1.2 versions.

Affected:

up to 1.2.1

Fix:

No patched version reported

Disclosed:

Aug 8, 2023

CVE-2023-27415 on NVD →

The LetterPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web...

CVSS:

4.4

Affected:

up to 1.2.2

Fix:

No patched version reported

Disclosed:

May 11, 2023

CVE-2023-27415 on NVD →