Product by Contrid
Newsletters
13 known vulnerabilities in Newsletters (Contrid), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-3018 | Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter | 7.5 | |
| High | CVE-2025-4857 | Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion | 7.2 | |
| High | CVE-2024-8247 | Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation | 8.8 | |
| Medium | CVE-2026-122063 | Newsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta | 6.5 | |
| Medium | CVE-2026-12938 | Contrid Newsletters: Cross-site Scripting | 6.4 | |
| Medium | CVE-2026-12939 | Contrid Newsletters: Cross-site Scripting | 6.4 | |
| Medium | CVE-2026-101325 | Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter | 5.3 | |
| Medium | CVE-2026-75908 | Contrid Newsletters: Missing Authorization | 4.3 | |
| Medium | CVE-2025-3107 | Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter | 6.5 | |
| High | CVE-2025-2009 | Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting | 7.2 | |
| Medium | CVE-2024-10181 | Contrid Newsletters: Cross-site Scripting | 6.4 | |
| Medium | CVE-2024-7411 | Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure | 5.3 | |
| Medium | CVE-2024-13739 | Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter | 6.1 |