Now officially on WordPress.org

CVE Database / CVE-2025-67999

CVE · High

CVE-2025-67999 — Newsletter – Send awesome emails from WordPress [newsletter] < 9.1.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-67999 Newsletter – Send awesome emails from WordPress [newsletter] < 9.1.0 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') High 7.6 < 9.1.0 9.1.0 2025-12-15 —

CVE-2025-67999

The Newsletter plugin for WordPress versions 9.0.9 and earlier is susceptible to SQL Injection attacks because user-supplied parameters are not properly escaped and the SQL queries lack adequate preparation. Authenticated attackers with administrative privileges can exploit this by injecting additional SQL commands, potentially leading to the exposure of sensitive data from the database.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings