Newsletter
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:newsletter:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Newsletter (cc17944e-b7d0-5689-ace8-a503edbd6a89) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-86824 |
vulnerable | 2026-10-13 12:28:46.579064 |
Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
Published: 2026-09-17T06:00:11.009Z
Updated: 2026-09-17T12:28:59.722Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86823 |
vulnerable | 2026-10-13 12:28:46.412526 |
Newsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber record's front-end actions.
Published: 2026-09-16T06:00:16.296Z
Updated: 2026-09-17T12:33:42.412Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3584 |
vulnerable | 2026-06-08 07:23:09.408741 |
Newsletter < 8.8.2 - Admin+ Stored XSS via Subscription
The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Published: 2025-06-03T06:00:16.525Z
Updated: 2025-06-03T15:32:46.821Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3583 |
vulnerable | 2026-06-08 07:23:09.408274 |
Newsletter < 8.7.1 - Admin+ Stored XSS
The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Published: 2025-05-05T06:00:03.098Z
Updated: 2025-05-05T14:27:58.842Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3582 |
vulnerable | 2026-06-08 07:23:09.407922 |
Newsletter < 8.8.5 - Admin+ Stored XSS via Form
The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Published: 2025-06-09T06:00:13.973Z
Updated: 2025-06-10T15:14:20.966Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3581 |
vulnerable | 2026-06-08 07:23:09.406645 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.