Newsmanapp Vulnerabilities

The NewsmanApp plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.7. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick...

CVSS:

4.3

Affected:

up to 2.7.7

Fixed in:

3.0.0

Disclosed:

Sep 26, 2025

CVE-2025-60164 on NVD →

[en] The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'newsman_subscribe_widget' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke...

Affected:

up to 2.7.7

Fixed in:

2.7.7

Disclosed:

Dec 13, 2024

CVE-2024-11767 on NVD →

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'newsman_subscribe_widget' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, w...

CVSS:

6.4

Affected:

up to 2.7.6

Fixed in:

2.7.7

Disclosed:

Dec 12, 2024

CVE-2024-11767 on NVD →

Affected:

up to 2.7.7

Fix:

No patched version reported

CVE-2025-60164 on NVD →