5.3
Moyenne
CVE-2026-86823 The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public…
Description
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber record's front-end actions.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Newsletter 9.3 | premières → < 9.3.7 | 9.3.7 |
Autres CVE de Newsletter
Les 6 CVE de Newsletter →
CVE-2026-86824
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy…
4.8
Moyenne
CVE-2025-3582
The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow…
4.8
Moyenne
CVE-2025-3581
The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before…
4.8
Moyenne
CVE-2025-3584
The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which…
4.8
Moyenne