GCVE - cpe:2.3:a:unknown:newsletters:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:newsletters:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Newsletters (`0a193077-d0b6-5dd4-8fd1-c7f3f8ed3826`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-16268`	vulnerable	2026-09-16 04:32:57.142157	Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts. Published: 2026-08-06T06:00:09.742Z Updated: 2026-08-06T14:08:39.333Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/65612dd4-83d8-40c5-8e12-862e9b5f940b/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-16269`	vulnerable	2026-09-16 04:32:56.830547	Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled. Published: 2026-08-08T06:00:10.712Z Updated: 2026-08-11T19:33:17.675Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/8b09afba-16a5-4d6c-9e85-84433a3c0d66/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-16267`	vulnerable	2026-09-16 04:32:56.714175	Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects. Published: 2026-08-08T06:00:10.538Z Updated: 2026-08-11T19:32:29.821Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/b51c11d6-5bfa-4b2c-b348-cda19889deee/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-12583`	vulnerable	2026-07-29 00:23:32.448579	Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server. Published: 2026-07-14T06:00:02.660Z Updated: 2026-07-14T12:28:44.066Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/e4c44105-f43d-4dff-8487-7d8ae2691c4e/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-4797`	vulnerable	2026-06-08 06:16:14.572340	Newsletter Lite < 4.9.3 - Admin+ Command Injection The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server. Published: 2024-01-16T15:56:40.507Z Updated: 2025-06-11T16:43:37.677Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.