Newsletter Manager Vulnerabilities

The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due to unsanitized input from the 'customFieldsDetails' parameter being passed through a deserialization function. This potentially makes it possible for unauthenticated attackers to in...

CVSS:

9.8

Affected:

up to 1.5.1

Fix:

No patched version reported

Disclosed:

Dec 29, 2020

CVE-2020-36727 on NVD →

The Newsletter Manager plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 1.4. This is due to improper validation of the 'appurl' parameter. This makes it possible for unauthenticated attackers to redirect traffic to a potentially malicious arbitrary website.

CVSS:

6.1

Affected:

up to 1.4

Fixed in:

1.5

Disclosed:

May 18, 2019

Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin before 1.4 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion attacks.

CVSS:

8.8

Affected:

up to 1.4

Fixed in:

1.4

Disclosed:

Jan 16, 2014

CVE-2012-6629 on NVD →

Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin before 1.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

CVSS:

6.1

Affected:

up to 1.0.2

Fixed in:

1.0.2

Disclosed:

May 15, 2012

CVE-2012-6627 on NVD →

Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_campaign.php, (3) xyz_em_email parameter to admin/edit_email.php, (4) x...

CVSS:

6.1

Affected:

up to 1.0.2

Fixed in:

1.0.2

Disclosed:

May 15, 2012

CVE-2012-6628 on NVD →