4.8
Moyenne
CVE-2025-3581 The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before…
Description
The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Newsletter 8.8 | premières → < 8.8.5 | 8.8.5 |
Autres CVE de Newsletter
Les 6 CVE de Newsletter →
CVE-2026-86824
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy…
4.8
Moyenne
CVE-2026-86823
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public…
5.3
Moyenne
CVE-2025-3582
The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow…
4.8
Moyenne
CVE-2025-3584
The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which…
4.8
Moyenne