7.2
Élevée
CVE-2023-4797 The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended…
Description
The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Newsletters 4.9 | premières → < 4.9.3 | 4.9.3 |
Autres CVE de Newsletters
Les 8 CVE de Newsletters →
CVE-2026-16264
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber…
6.5
Moyenne
CVE-2026-17522
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its…
5.4
Moyenne
CVE-2026-17520
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source,…
4.8
Moyenne
CVE-2026-16269
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing…
4.8
Moyenne