3.5
Faible
CVE-2025-3583 The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow…
Description
The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Newsletter 8.7 | premières → < 8.7.1 | 8.7.1 |
Autres CVE de Newsletter
Les 6 CVE de Newsletter →
CVE-2026-86824
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy…
4.8
Moyenne
CVE-2026-86823
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public…
5.3
Moyenne
CVE-2025-3582
The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow…
4.8
Moyenne
CVE-2025-3581
The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before…
4.8
Moyenne