7.2
High
CVE-2023-4797 The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended…
Description
The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Newsletters 4.9 | earliest → < 4.9.3 | 4.9.3 |
Other CVEs of Newsletters
The 8 CVEs of Newsletters →
CVE-2026-16264
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber…
6.5
Medium
CVE-2026-17522
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its…
5.4
Medium
CVE-2026-17520
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source,…
4.8
Medium
CVE-2026-16269
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing…
4.8
Medium