Is Newsletter safe?

Every recorded flaw

• Oct 2, 2026Newsletter – Send awesome emails from: Stored Cross-Site ScriptingCVE-2026-96566 · affects up to 9.4.0 · reported by WordfenceHigh 7.2
• Sep 30, 2026Newsletter – Send awesome emails from: Insufficiently Protected CredentialsCVE-2026-92537 · affects up to 9.3.9 · reported by WordfenceMedium 5.3
• Sep 18, 2026Newsletter – Send awesome emails from: Reflected Cross-Site ScriptingCVE-2026-90981 · affects up to 9.3.8 · reported by WordfenceMedium 6.1
• Sep 17, 2026Newsletter: Does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hashCVE-2026-86824 · fixed in 9.3.8 · reported by WPScanMedium 4.8
• Sep 16, 2026Newsletter: Does not validate the destination of the redirect performed after a public subscription actionCVE-2026-86823 · fixed in 9.3.7 · reported by WPScanMedium 5.3
• Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.CVE-2026-66596 · affects up to 9.3.3 · reported by PatchstackHigh 7.1
• Jan 19, 2026Newsletter – Send awesome emails from: Cross-Site Request ForgeryCVE-2026-1051 · affects up to 9.1.0 · reported by WordfenceMedium 4.3
• Dec 16, 2025Newsletter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67999 · affects up to 9.0.9 · reported by PatchstackHigh 7.6
• Jun 9, 2025Newsletter: Does not sanitise and escape some of its Form settingsCVE-2025-3582 · fixed in 8.85 · reported by WPScanMedium 4.8
• Jun 9, 2025Newsletter: Does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embedCVE-2025-3581 · fixed in 8.8.5 · reported by WPScanMedium 4.8
• Jun 3, 2025Newsletter: Does not sanitise and escape some of its Subscription settingsCVE-2025-3584 · fixed in 8.8.2 · reported by WPScanMedium 4.8
• May 5, 2025Newsletter: Does not sanitise and escape some of its settingsCVE-2025-3583 · fixed in 8.7.1 · reported by WPScanMedium 4.8
• Jun 4, 2024Newsletter: Stored Cross-Site ScriptingCVE-2024-5317 · affects up to 8.3.4 · reported by WordfenceMedium 6.4
• May 17, 2024Newsletter: Authentication Bypass by SpoofingCVE-2024-30522 · affects up to 8.2.0 · reported by PatchstackMedium 5.3
• Apr 15, 2024Newsletter: Cross-Site Request Forgery (CSRF)CVE-2024-31434 · affects up to 8.0.6 · reported by PatchstackMedium 5.4
• Sep 6, 2023Newsletter: Stored Cross-Site ScriptingCVE-2023-4772 · affects up to 7.8.9 · reported by WordfenceMedium 6.4
• May 22, 2023Newsletter versions prior to 7.6.9: Cross-site scriptingCVE-2023-27922 · fixed in 7.6.9 · reported by vultures@jpcert.or.jp1.2% oddsMedium 6.1
• Jun 20, 2022Newsletter: Does not escape and sanitise the preheader_text settingCVE-2022-1889 · fixed in 7.4.6 · reported by WPScanMedium 4.8
• Jun 13, 2022Newsletter: Does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pagesCVE-2022-1756 · fixed in 7.4.5 · reported by WPScan1.9% oddsMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.