Skip to content
OpenAdvisories

Vendor

satollo

7 known vulnerabilities.

Products

Newsletter – Send awesome emails from WordPress 6 Head, Footer and Post Injections 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-92537

    Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)

    The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route `/tnp/l/` is registered with `permission_c…

    satollo Newsletter – Send awesome emails from WordPress Web / CMS
  • Medium 6.1
    CVE-2026-90981

    Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter

    The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes …

    satollo Newsletter – Send awesome emails from WordPress Web / CMS
  • Medium 4.3
    CVE-2026-1051

    Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription

    The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1.0. This is due to missing or incorrect nonce validation on the hook_newsletter_action() function. Th…

    satollo Newsletter – Send awesome emails from WordPress Web / CMS
  • Medium 4.1
    CVE-2024-13900

    Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments

    The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject PHP Code in mul…

    satollo Head, Footer and Post Injections Web / CMS
  • Medium 6.4
    CVE-2024-5317

    Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1

    The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke…

    satollo Newsletter – Send awesome emails from WordPress Web / CMS
  • Medium 6.4
    CVE-2023-4772

    Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletter_form' shortcode in versions up to, and including, 7.8.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it …

    satollo Newsletter – Send awesome emails from WordPress Web / CMS