5.3
Medium
CVE-2026-86823 The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public…
Description
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber record's front-end actions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Newsletter 9.3 | earliest → < 9.3.7 | 9.3.7 |
Other CVEs of Newsletter
The 6 CVEs of Newsletter →
CVE-2026-86824
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy…
4.8
Medium
CVE-2025-3582
The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow…
4.8
Medium
CVE-2025-3581
The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before…
4.8
Medium
CVE-2025-3584
The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which…
4.8
Medium