PLUGIN SECURITY
Is Newsletters safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Newsletters WordPress plugin — checked against WP Clinic's local security database.
What this plugin does
- Slug:
newsletters-lite
Maintenance status
Known vulnerabilities
46 known CVEs on file for Newsletters.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-119512 | Deserialization of Untrusted Data | Deserialization of Untrusted Data | High 8.8 | < 4.18.3 | 4.18.3 | 2026-11-13 | — |
| CVE-2026-124265 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.5 | < 4.18.2 | 4.18.2 | 2026-11-13 | — |
| CVE-2026-101325 | Newsletters [newsletters-lite] < 4.18.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 5.3 | < 4.18.2 | 4.18.2 | 2026-10-27 | — |
| CVE-2026-111402 | Newsletters [newsletters-lite] < 4.18.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.3 | < 4.18.2 | 4.18.2 | 2026-10-24 | — |
| CVE-2026-94075 | Newsletters [newsletters-lite] < 4.18.2 | — | Critical 9.8 | < 4.18.2 | 4.18.2 | 2026-10-24 | — |
| — | Newsletters [newsletters-lite] <= 4.18.3 (unfixed) | — | Critical 9.6 | < 4.18.3 | 4.18.3 | 2026-10-22 | — |
| CVE-2026-16264 | Newsletters [newsletters-lite] < 4.18.1 | Authorization Bypass Through User-Controlled Key | Unknown | < 4.18.1 | 4.18.1 | 2026-09-17 | — |
| CVE-2026-17520 | Newsletters [newsletters-lite] < 4.17 | Inadequate Encryption Strength | Medium 4.8 | < 4.17 | 4.17 | 2026-08-29 | — |
+ 49 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-66619 | Newsletters [newsletters-lite] < 4.18.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.6 | < 4.18.1 | 4.18.1 | 2026-08-29 | — |
| CVE-2026-17522 | Newsletters [newsletters-lite] < 4.17 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 4.17 | 4.17 | 2026-08-27 | — |
| CVE-2026-16269 | Newsletters [newsletters-lite] < 4.16 | Improper Authentication | Unknown | < 4.16 | 4.16 | 2026-08-08 | — |
| CVE-2026-16268 | Newsletters [newsletters-lite] < 4.16 | Server-Side Request Forgery (SSRF) | Unknown | < 4.16 | 4.16 | 2026-08-06 | — |
| CVE-2026-16267 | Newsletters [newsletters-lite] < 4.16 | Deserialization of Untrusted Data | Unknown | < 4.16 | 4.16 | 2026-08-03 | — |
| CVE-2026-75908 | Newsletters [newsletters-lite] < 4.18 | Missing Authorization | Medium 4.3 | < 4.18 | 4.18 | 2026-08-03 | — |
| CVE-2026-12939 | Newsletters [newsletters-lite] < 4.16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 4.16 | 4.16 | 2026-07-28 | — |
| CVE-2026-12938 | Newsletters [newsletters-lite] < 4.16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 4.16 | 4.16 | 2026-07-28 | — |
| CVE-2026-57394 | Newsletters [newsletters-lite] < 4.15 | — | High 7.1 | < 4.15 | 4.15 | 2026-07-08 | — |
| CVE-2026-57645 | Newsletters [newsletters-lite] < 4.14 | Missing Authorization | High 8.1 | < 4.14 | 4.14 | 2026-06-26 | — |
| CVE-2026-12583 | Newsletters [newsletters-lite] < 4.15 | Deserialization of Untrusted Data | Unknown | < 4.15 | 4.15 | 2026-06-23 | — |
| CVE-2026-54840 | Newsletters [newsletters-lite] < 4.14 | Missing Authorization | High 7.3 | < 4.14 | 4.14 | 2026-06-18 | — |
| CVE-2026-3018 | Newsletters [newsletters-lite] < 4.14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 4.14 | 4.14 | 2026-06-09 | — |
| CVE-2025-67911 | Newsletters [newsletters-lite] < 4.12 | Deserialization of Untrusted Data | Critical 9.8 | < 4.12 | 4.12 | 2025-12-31 | — |
| CVE-2025-69020 | Newsletters [newsletters-lite] < 4.13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 4.13 | 4.13 | 2025-12-28 | — |
| CVE-2025-54034 | Newsletters [newsletters-lite] < 4.11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | High 7.5 | < 4.11 | 4.11 | 2025-07-29 | — |
| CVE-2025-54035 | Newsletters [newsletters-lite] < 4.11 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 4.11 | 4.11 | 2025-07-16 | — |
| CVE-2025-30921 | Newsletters [newsletters-lite] < 4.9.9.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.6 | < 4.9.9.8 | 4.9.9.8 | 2025-03-27 | — |
| CVE-2024-13739 | Newsletters [newsletters-lite] < 4.9.9.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.9.9.8 | 4.9.9.8 | 2025-03-21 | — |
| CVE-2025-24599 | Newsletters [newsletters-lite] < 4.9.9.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 4.9.9.7 | 4.9.9.7 | 2024-12-26 | — |
| CVE-2024-10181 | Newsletters [newsletters-lite] < 4.9.9.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 4.9.9.5 | 4.9.9.5 | 2024-10-28 | — |
| CVE-2024-47346 | Newsletters [newsletters-lite] < 4.9.9.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 4.9.9.2 | 4.9.9.2 | 2024-09-27 | — |
| CVE-2024-8247 | Newsletters [newsletters-lite] < 4.9.9.3 | Improper Privilege Management | High 8.8 | < 4.9.9.3 | 4.9.9.3 | 2024-09-05 | — |
| CVE-2024-43279 | Newsletters [newsletters-lite] < 4.9.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 4.9.9 | 4.9.9 | 2024-08-16 | — |
| CVE-2024-7411 | Newsletters [newsletters-lite] < 4.9.9.1 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 4.9.9.1 | 4.9.9.1 | 2024-08-14 | — |
| CVE-2024-37227 | Newsletters [newsletters-lite] < 4.9.8 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 4.9.8 | 4.9.8 | 2024-06-21 | — |
| CVE-2024-35718 | Newsletters [newsletters-lite] < 4.9.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.9.6 | 4.9.6 | 2024-06-06 | — |
| CVE-2024-32954 | Newsletters [newsletters-lite] < 4.9.6 | Unrestricted Upload of File with Dangerous Type | Critical 9.1 | < 4.9.6 | 4.9.6 | 2024-04-22 | — |
| CVE-2024-32953 | Newsletters [newsletters-lite] < 4.9.6 | Insertion of Sensitive Information into Log File | High 7.5 | < 4.9.6 | 4.9.6 | 2024-04-22 | — |
| CVE-2023-4797 | Newsletters [newsletters-lite] < 4.9.3 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | High 7.2 | < 4.9.3 | 4.9.3 | 2023-10-05 | — |
| CVE-2023-30478 | Newsletters [newsletters-lite] < 4.9.9 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 4.9.9 | 4.9.9 | 2023-04-13 | — |
| — | Newsletters [newsletters-lite] < 4.6.18 | — | Unknown | < 4.6.18 | 4.6.18 | 2019-07-11 | — |
| CVE-2019-14788 | Newsletters [newsletters-lite] < 4.6.19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 8.8 | < 4.6.19 | 4.6.19 | 2019-07-01 | — |
| CVE-2019-14787, CVE-2019-14788 | Newsletters [newsletters-lite] < 4.6.19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.6.19 | 4.6.19 | 2019-07-01 | — |
| CVE-2018-20987 | Newsletters [newsletters-lite] < 4.6.8.6 | Deserialization of Untrusted Data | Critical 9.8 | < 4.6.8.6 | 4.6.8.6 | 2018-03-12 | — |
| — | Newsletters [newsletters-lite] < 4.6.5 | — | Unknown | < 4.6.5 | 4.6.5 | 2017-05-29 | — |
| — | Newsletters [newsletters-lite] < 4.6.5 | — | Unknown | < 4.6.5 | 4.6.5 | 2017-05-29 | — |
| — | Newsletters [newsletters-lite] < 4.6.5.3 | — | Unknown | < 4.6.5.3 | 4.6.5.3 | 2017-05-29 | — |
| — | Newsletters [newsletters-lite] < 4.6.4.3 | — | Unknown | < 4.6.4.3 | 4.6.4.3 | 2017-05-29 | — |
| — | Newsletters [newsletters-lite] < 4.9.9.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 4.9.9.8 | 4.9.9.8 | 0000-00-00 | — |
| — | Newsletters [newsletters-lite] < 4.9.9.9 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 4.9.9.9 | 4.9.9.9 | 0000-00-00 | — |
| — | Newsletters [newsletters-lite] < 4.10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.2 | < 4.10 | 4.10 | 0000-00-00 | — |
| CVE-2026-122063 | Newsletters [newsletters-lite] < 4.18.3 | Improper Neutralization of Special Elements used in an SQL Command | Medium 6.5 | < 4.18.3 | 4.18.3 | 0000-00-00 | — |
| — | Newsletters [newsletters-lite] < 4.6.5 | — | Unknown | < 4.6.5 | 4.6.5 | — | — |
| — | Tribulant Newsletters < 4.6.5 – Multiple Vulnerabilities | — | Unknown | < 4.6.5 | 4.6.5 | — | — |
| CVE-2025-2009 | Newsletters < 4.9.9.8 - Unauthenticated Stored Cross-Site Scripting | — | Unknown | < 4.9.9.8 | 4.9.9.8 | — | — |
| CVE-2025-3107 | Newsletters < 4.9.9.9 - Authenticated (Contributor+) SQL Injection orderby Parameter | — | Unknown | < 4.9.9.9 | 4.9.9.9 | — | — |
| CVE-2025-4857 | Newsletters < 4.10 - Authenticated (Administrator+) Local File Inclusion | — | Unknown | < 4.10 | 4.10 | — | — |
| CVE-2026-116863 | Newsletters <= 4.18.2 - Cross-Site Request Forgery | — | Unknown | not specified | no fix on file | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
1 of the vulnerabilities above has no fixed version on file — there's no update that resolves it. Consider deactivating this plugin or switching to one of the alternatives below.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.