PLUGIN SECURITY
Is Newsletter safe?
An email marketing tool for your blog: subscription forms to create your lists with unlimited subscribers and newsletters.
What this plugin does
- Slug:
newsletter - Author: Stefano Lissa
- 200000+ active installs
- 92/100 rating (1204 reviews on wordpress.org)
- 36276351 all-time downloads
- On WordPress.org since 2009-05-23
Email Marketingnewslettersignup formssubscriptionwelcome email
Maintenance status
- Latest known version: 9.3.3
- Last updated: 2026-10-22 6:46pm GMT
- Tested up to WordPress: 7.1.3
- Requires PHP: 7.0+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
21 known CVEs on file for Newsletter.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-96566 | Newsletter – Send awesome emails from WordPress [newsletter] < 9.4.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 9.4.1 | 9.4.1 | 2026-09-30 | ⚠ update needed |
| CVE-2026-92537 | Newsletter – Send awesome emails from WordPress [newsletter] < 9.4.0 | Insufficiently Protected Credentials | Medium 5.3 | < 9.4.0 | 9.4.0 | 2026-09-17 | ⚠ update needed |
| CVE-2026-86823 | Newsletter – Send awesome emails from WordPress [newsletter] < 9.3.7 | URL Redirection to Untrusted Site ('Open Redirect') | Unknown | < 9.3.7 | 9.3.7 | 2026-09-15 | ⚠ update needed |
| CVE-2026-86824 | Newsletter – Send awesome emails from WordPress [newsletter] < 9.3.8 | Inadequate Encryption Strength | Unknown | < 9.3.8 | 9.3.8 | 2026-09-14 | ⚠ update needed |
| CVE-2026-66596 | Newsletter – Send awesome emails from WordPress [newsletter] < 9.3.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 9.3.4 | 9.3.4 | 2026-08-19 | ⚠ update needed |
| CVE-2026-90981 | Newsletter – Send awesome emails from WordPress [newsletter] < 9.3.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 9.3.9 | 9.3.9 | 2026-08-19 | ⚠ update needed |
| CVE-2025-67999 | Newsletter – Send awesome emails from WordPress [newsletter] < 9.1.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.6 | < 9.1.0 | 9.1.0 | 2025-12-15 | ✓ fixed in latest |
| CVE-2024-5317 | Newsletter – Send awesome emails from WordPress [newsletter] < 8.3.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 8.3.5 | 8.3.5 | 2024-06-04 | ✓ fixed in latest |
+ 41 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-31434 | Newsletter – Send awesome emails from WordPress [newsletter] < 8.0.7 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 8.0.7 | 8.0.7 | 2024-04-10 | ✓ fixed in latest |
| CVE-2024-30522 | Newsletter – Send awesome emails from WordPress [newsletter] < 8.2.1 | Authentication Bypass by Spoofing | Medium 5.3 | < 8.2.1 | 8.2.1 | 2024-03-28 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 8.0.7 | — | Unknown | < 8.0.7 | 8.0.7 | 2024-01-10 | ✓ fixed in latest |
| CVE-2023-4772 | Newsletter – Send awesome emails from WordPress [newsletter] < 7.9.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 7.9.0 | 7.9.0 | 2023-08-17 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 7.6.9 | — | Unknown | < 7.6.9 | 7.6.9 | 2023-03-29 | ✓ fixed in latest |
| CVE-2023-27922 | Newsletter – Send awesome emails from WordPress [newsletter] < 7.6.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 7.6.9 | 7.6.9 | 2023-03-27 | ✓ fixed in latest |
| CVE-2022-1889 | Newsletter – Send awesome emails from WordPress [newsletter] < 7.4.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 7.4.6 | 7.4.6 | 2022-05-30 | ✓ fixed in latest |
| CVE-2022-1756 | Newsletter – Send awesome emails from WordPress [newsletter] < 7.4.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 7.4.5 | 7.4.5 | 2022-05-23 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 7.4.5 | — | Unknown | < 7.4.5 | 7.4.5 | 2022-05-17 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 6.5.4 | — | Unknown | < 6.5.4 | 6.5.4 | 2021-03-16 | ✓ fixed in latest |
| CVE-2020-35933 | Newsletter – Send awesome emails from WordPress [newsletter] < 6.8.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 6.8.2 | 6.8.2 | 2020-08-03 | ✓ fixed in latest |
| CVE-2020-35932 | Newsletter – Send awesome emails from WordPress [newsletter] < 6.8.2 | Deserialization of Untrusted Data | High 8.8 | < 6.8.2 | 6.8.2 | 2020-08-02 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 6.7.7 | — | Unknown | < 6.7.7 | 6.7.7 | 2020-07-12 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 6.7.7 | — | Unknown | < 6.7.7 | 6.7.7 | 2020-07-12 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 6.5.4 | — | Unknown | < 6.5.4 | 6.5.4 | 2020-03-16 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 3.0.9 | — | Unknown | < 3.0.9 | 3.0.9 | 2015-10-18 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 3.2.7 | — | Unknown | < 3.2.7 | 3.2.7 | 2015-05-15 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 3.8.3 | — | Unknown | < 3.8.3 | 3.8.3 | 2015-03-30 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 3.8.3 | — | Unknown | < 3.8.3 | 3.8.3 | 2015-03-30 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 3.2.7 | — | Unknown | < 3.2.7 | 3.2.7 | 2013-05-14 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 8.7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 8.7.1 | 8.7.1 | 0000-00-00 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 8.8.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 8.8.2 | 8.8.2 | 0000-00-00 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 9.1.1 | — | Unknown | < 9.1.1 | 9.1.1 | 0000-00-00 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 8.8.5 | — | Medium 4.8 | < 8.8.5 | 8.8.5 | 0000-00-00 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 8.8.5 | — | Medium 4.8 | < 8.8.5 | 8.8.5 | 0000-00-00 | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 6.7.7 | — | Unknown | < 6.7.7 | 6.7.7 | — | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 6.5.4 | — | Unknown | < 6.5.4 | 6.5.4 | — | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 3.8.3 | — | Unknown | < 3.8.3 | 3.8.3 | — | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 3.2.7 | — | Unknown | < 3.2.7 | 3.2.7 | — | ✓ fixed in latest |
| — | Newsletter – Send awesome emails from WordPress [newsletter] < 3.0.9 | — | Unknown | < 3.0.9 | 3.0.9 | — | ✓ fixed in latest |
| — | Newsletter < 3.0.9 - SQL Injection | — | Unknown | < 3.0.9 | 3.0.9 | — | ✓ fixed in latest |
| — | Newsletter < 3.2.7 - Cross-Site Scripting (XSS) | — | Unknown | < 3.2.7 | 3.2.7 | — | ✓ fixed in latest |
| — | Newsletter 3.7.0 - Open Redirect | — | Unknown | < 3.8.3 | 3.8.3 | — | ✓ fixed in latest |
| — | Newsletter < 6.5.4 - CSV Injection | — | Unknown | < 6.5.4 | 6.5.4 | — | ✓ fixed in latest |
| — | Newsletter < 6.7.7 - Authenticated Stored Cross-Site Scripting | — | Unknown | < 6.7.7 | 6.7.7 | — | ✓ fixed in latest |
| CVE-2023-27922 | Newsletter < 7.6.9 - Reflected XSS | — | Unknown | < 7.6.9 | 7.6.9 | — | ✓ fixed in latest |
| CVE-2025-3583 | Newsletter < 8.7.1 - Admin+ Stored XSS | — | Unknown | < 8.7.1 | 8.7.1 | — | ✓ fixed in latest |
| CVE-2025-3584 | Newsletter < 8.8.2 - Admin+ Stored XSS via Subscription | — | Unknown | < 8.8.2 | 8.8.2 | — | ✓ fixed in latest |
| CVE-2025-3582 | Newsletter < 8.8.5 - Admin+ Stored XSS via Form | — | Unknown | < 8.8.5 | 8.8.5 | — | ✓ fixed in latest |
| CVE-2025-3581 | Newsletter < 8.8.5 - Admin+ Stored XSS via Widget | — | Unknown | < 8.8.5 | 8.8.5 | — | ✓ fixed in latest |
| CVE-2026-1051 | Newsletter – Send awesome emails from WordPress < 9.1.1 - Cross-Site Request Forgery to Newsletter Unsubscription | — | Unknown | < 9.1.1 | 9.1.1 | — | ✓ fixed in latest |
How to fix it
Keep Newsletter updated — 9.3.3 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Hostinger Reach – AI-Powered Email Marketing for WordPress — 1000000+ active installs — 100/100 (8) — max PHP 8.4
- MC4WP: Mailchimp for WordPress — 1000000+ active installs — 96/100 (1497) — max PHP 8.4
- MailPoet – Newsletters, Email Marketing, and Automation — 500000+ active installs — 88/100 (1433)
- Brevo – Email, SMS, Web Push, Chat, and more. — 100000+ active installs — 82/100 (284) — max PHP 8.4
- Newsletters, Email Marketing, SMS and Popups by Omnisend — 100000+ active installs — 96/100 (16) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.