Unknown Newsletter – Send Awesome Emails From Wordpress vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Newsletter – Send Awesome Emails From Wordpress, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

MediumCVE-2022-1889thenewsletterplugin · newsletter +2 more4y agoNewsletter < 7.4.6 - Admin+ Stored Cross-Site ScriptingThe Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowedEPSS0.59%MediumCVE-2022-1756thenewsletterplugin · newsletter +2 more4y agoNewsletter < 7.4.5 - Reflected Cross-Site ScriptingThe Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.EPSS1.94%