Är Newsletter – Send awesome emails from WordPress säkert att använda?

Newsletter – Send awesome emails from WordPress har 56 kända sårbarheter. De flesta åtgärdas i nya versioner. Håll alltid tillägget uppdaterat för bästa skydd.

Hur vet jag om min sajt är påverkad?

Kör ett gratis test på sitesupport.co/testa-din-hemsida. Testet kontrollerar vilka tillägg och versioner du använder och jämför mot kända sårbarheter.

Vad ska jag göra om jag har en sårbar version?

Uppdatera till senaste versionen så snart som möjligt. Om ingen fix finns tillgänglig, överväg att tillfälligt inaktivera tillägget.

Newsletter – Send awesome emails from WordPress

Name: Newsletter – Send awesome emails from WordPress
Rating: 4.6

4.6/5

200 000+ installationer

An email marketing tool for your blog: subscription forms to create your lists with unlimited subscribers and newsletters.

Kända sårbarheter

Kritiska / höga

2026-01-19

Senaste sårbarhet

200 000+

Aktiva installationer

Om Newsletter – Send awesome emails from WordPress

Newsletter-tillägget är ett populärt verktyg för e-postmarknadsföring som låter dig skapa prenumerationsformulär och skicka nyhetsbrev direkt från din WordPress-sajt. Med över 200 000 aktiva installationer är det ett välkänt alternativ för företag som vill bygga upp sin e-postlista.

Säkerhetsläget för Newsletter-tillägget

Ur säkerhetsperspektiv visar tillägget en problematisk historik med totalt 50 dokumenterade sårbarheter. Särskilt oroande är de 2 kritiska och 11 högrisk-sårbarheter som har upptäckts. Den senaste kända säkerhetsluckan rapporterades i juni 2023, vilket tyder på att utvecklarna arbetar kontinuerligt med säkerhetsuppdateringar.

Vad betyder detta i praktiken?

De kritiska sårbarheterna kan potentiellt ge obehöriga användare tillgång till din sajt eller känslig data som e-postlistor. Medium- och högrisk-sårbarheter kan möjliggöra mindre allvarliga intrång men bör ändå tas på allvar.

Våra rekommendationer

Håll alltid tillägget uppdaterat till senaste versionen
Övervaka regelbundet för säkerhetsuppdateringar
Överväg alternativa lösningar om säkerheten är kritisk för din verksamhet
Implementera säkerhetskopieringsrutiner

Kom ihåg att regelbundna uppdateringar är ditt bästa skydd mot kända säkerhetshot. Kontakta oss på Sitesupport om du behöver hjälp med säker WordPress-underhållning.

Använder du Newsletter – Send awesome emails from WordPress?

Kör ett gratis test och se om din hemsida är påverkad av dessa sårbarheter.

Testa din hemsida

Alla kända sårbarheter

Medel 2026-01-19 CVE-2026-1051

Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription

Påverkade versioner: <= 9.1.0

Medel 2025-12-15 CVE-2025-67999

Newsletter <= 9.0.9 - Authenticated (Administrator+) SQL Injection

Påverkade versioner: <= 9.0.9

Medel 2025-05-19 CVE-2025-3582

Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

Påverkade versioner: <= 8.8.4

Medel 2025-05-19 CVE-2025-3581

Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

Påverkade versioner: <= 8.8.4

Medel 2025-05-13 CVE-2025-3584

Newsletter <= 8.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting

Påverkade versioner: <= 8.8.1

Medel 2025-04-14 CVE-2025-3583

Newsletter <= 8.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting

Påverkade versioner: <= 8.7.0

Medel 2023-06-05 CVE-2023-2472

CVE-2023-2472: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when...

Påverkade versioner: < 3.1.61

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when the WPML plugin is also active and configured, leadi...

Medel 2023-06-04 CVE-2013-10028

CVE-2013-10028: A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the function style_newsletter of the file lettreinfo.php. The manip...

Påverkade versioner: <= 2.9.0

A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the function style_newsletter of the file lettreinfo.php. The manipulation of the argument email leads to cross site scr...

Hög 2023-05-30 CVE-2023-0766

CVE-2023-0766: The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_n...

Påverkade versioner: <= 1.2

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with...

Medel 2023-05-30 CVE-2023-0733

CVE-2023-0733: The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks

Påverkade versioner: <= 1.2

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks

Medel 2023-02-27 CVE-2023-0543

CVE-2023-0543: The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cr...

Påverkade versioner: < 2.1.7.2

The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_h...

Medel 2022-08-22 CVE-2022-2389

CVE-2022-2389: The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one...

Påverkade versioner: < 2.1.2

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users...

Medel 2022-06-20 CVE-2022-1889

CVE-2022-1889: The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the ...

Påverkade versioner: < 7.4.6

The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed

Medel 2022-06-13 CVE-2022-1756

CVE-2022-1756: The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers ...

Påverkade versioner: < 7.4.5

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulne...

Hög 2022-03-07 CVE-2022-0439

CVE-2022-0439: The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blin...

Påverkade versioner: < 5.3.2

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as...

Medel 2022-02-14 CVE-2021-25033

CVE-2021-25033: The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue

Påverkade versioner: < 1.6.5

The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue

Medel 2022-02-14 CVE-2021-24874

CVE-2021-24874: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading ...

Påverkade versioner: < 3.1.31

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Medel 2022-01-24 CVE-2021-24923

CVE-2021-24923: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, l...

Påverkade versioner: < 3.1.25

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

Medel 2021-08-16 CVE-2021-34658

CVE-2021-34658: The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/simple-popup-newsletter.php file which allows attackers ...

Påverkade versioner: <= 1.4.7

The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to an...

Hög 2021-08-05 CVE-2021-34634

CVE-2021-34634: The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitra...

Påverkade versioner: <= 4.0.23

The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.2...

Medel 2021-06-14 CVE-2021-24345

CVE-2021-24345: The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter befo...

Påverkade versioner: <= 2.5.1

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Bl...

Medel 2021-01-01 CVE-2020-35933

CVE-2020-35933: A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX r...

Påverkade versioner: < 6.8.2

A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options par...

Hög 2021-01-01 CVE-2020-35932

CVE-2020-35932: Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action t...

Påverkade versioner: < 6.8.2

Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline...

Medel 2020-09-10 CVE-2020-5780

CVE-2020-5780: Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthentica...

Påverkade versioner: < 4.5.6

Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing.

Medel 2020-07-17 CVE-2020-5768

CVE-2020-5768: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker t...

Påverkade versioner: all

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker to determine the value of database fields.

Medel 2020-07-17 CVE-2020-5767

CVE-2020-5767: Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted...

Påverkade versioner: all

Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link.

Medel 2020-03-13 CVE-2020-10195

CVE-2020-10195: The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions....

Påverkade versioner: < 3.64.1

The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post...

Kritisk 2020-01-08 CVE-2019-20361

CVE-2019-20361: There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnera...

Påverkade versioner: < 4.3.1

There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).

Medel 2019-12-26 CVE-2019-19985

CVE-2019-19985: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.

Påverkade versioner: < 4.2.3

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.

Medel 2019-12-26 CVE-2019-19984

CVE-2019-19984: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns.

Påverkade versioner: < 4.2.3

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns.

Medel 2019-12-26 CVE-2019-19982

CVE-2019-19982: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to se...

Påverkade versioner: < 4.2.3

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&option_name=...

Medel 2019-12-26 CVE-2019-19981

CVE-2019-19981: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.

Påverkade versioner: < 4.2.3

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.

Medel 2019-12-26 CVE-2019-19980

CVE-2019-19980: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) to send test emails from the administ...

Påverkade versioner: < 4.2.3

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) to send test emails from the administrative dashboard on behalf of an administrator. This...

Medel 2019-11-06 CVE-2018-20853

CVE-2018-20853: An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks.

Påverkade versioner: < 2.8.2

An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks.

Hög 2019-08-22 CVE-2018-20987

CVE-2018-20987: The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.

Påverkade versioner: < 4.6.8.6

The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.

Hög 2019-08-15 CVE-2019-14788

CVE-2019-14788: wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the...

Påverkade versioner: < 4.6.19

wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an e...

Medel 2019-08-14 CVE-2017-18512

CVE-2017-18512: The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.

Påverkade versioner: < 1.1.8

The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.

Medel 2019-08-09 CVE-2019-14787

CVE-2019-14787: The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.

Påverkade versioner: < 4.6.19

The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.

Medel 2019-07-28 CVE-2019-14364

CVE-2019-14364: An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using ...

Påverkade versioner: all

An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter...

Kritisk 2019-07-19 CVE-2019-13569

CVE-2019-13569: A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker t...

Påverkade versioner: <= 4.1.7

A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected syst...

Medel 2018-12-03 CVE-2018-1002000

CVE-2018-1002000: There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injecti...

Påverkade versioner: all

There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST req...

Hög 2018-10-18 CVE-2018-18461

CVE-2018-18461: The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments[] data to models/attachm...

Påverkade versioner: all

The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments[] data to models/attachment.php.

Medel 2018-01-26 CVE-2018-6015

CVE-2018-6015: An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_sub...

Påverkade versioner: < 3.4.8

An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV dat...

Medel 2018-01-01 CVE-2017-18010

CVE-2017-18010: The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter.

Påverkade versioner: < 2.0.0

The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter.

Medel 2014-08-26 CVE-2014-3907

CVE-2014-3907: Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 for WordPress allows remote attackers to hijack the authentication of arbitrary...

Påverkade versioner: <= 2.6.10

Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 for WordPress allows remote attackers to hijack the authentication of arbitrary users.

Hög 2014-07-27 CVE-2014-4726

CVE-2014-4726: Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

Påverkade versioner: <= 2.6.7

Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

Hög 2014-07-27 CVE-2014-4725

CVE-2014-4725: The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp...

Påverkade versioner: <= 2.6.6

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-c...

Medel 2014-07-11 CVE-2014-4939

CVE-2014-4939: SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in th...

Påverkade versioner: all

SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php.

Medel 2014-07-02 CVE-2014-4527

CVE-2014-4527: Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-marketing-y-newsletters-gratis) plugi...

Påverkade versioner: <= 1.97

Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-marketing-y-newsletters-gratis) plugin before 1.98 for WordPress allow remote attackers to...

Medel 2014-03-24 CVE-2013-1408

CVE-2013-1408: Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or ...

Påverkade versioner: <= 2.2

Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: t...

Medel 2014-01-16 CVE-2012-6629

CVE-2012-6629: Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for...

Påverkade versioner: <= 1.0.2

Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) con...

Medel 2014-01-16 CVE-2012-6628

CVE-2012-6628: Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_camp...

Påverkade versioner: <= 1.0.2

Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_c...

Medel 2014-01-16 CVE-2012-6627

CVE-2012-6627: Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via t...

Påverkade versioner: <= 1.0.2

Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

Medel 2012-06-19 CVE-2012-3588

CVE-2012-3588: Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.

Påverkade versioner: all

Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.

Hög 2008-10-21 CVE-2008-4625

CVE-2008-4625: SQL injection vulnerability in stnl_iframe.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter paramete...

Påverkade versioner: all

SQL injection vulnerability in stnl_iframe.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter, a different vector than CVE-2008-0683.

Hög 2008-02-12 CVE-2008-0683

CVE-2008-0683: SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter pa...

Påverkade versioner: all

SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.

Så skyddar du din sajt

Sårbarheter i tillägg är den vanligaste attackytan för WordPress-sajter. Det bästa skyddet är att vara proaktiv — här är tre konkreta steg.

Håll tillägget uppdaterat

De flesta sårbarheter i Newsletter – Send awesome emails from WordPress åtgärdas snabbt av utvecklarna. Uppdatera alltid till senaste versionen.

Ta bort oanvända tillägg

Varje tillägg är en potentiell attackyta. Avinstallera det du inte aktivt använder.

Bevaka automatiskt

Med löpande övervakning upptäcker du problem innan de blir allvarliga.

Vill du slippa hålla koll själv? Med ett supportavtal från Sitesupport sköter vi uppdateringar och säkerhet åt dig.

Vanliga frågor om Newsletter – Send awesome emails from WordPress

Newsletter – Send awesome emails from WordPress har 56 kända sårbarheter, varav 13 med hög eller kritisk allvarlighetsgrad. Det betyder inte nödvändigtvis att tillägget är osäkert — de flesta sårbarheter åtgärdas i nya versioner. Det viktigaste är att alltid köra den senaste versionen.

Det enklaste sättet är att köra ett gratis test av din hemsida på sitesupport.co. Testet kontrollerar vilka tillägg du använder och vilka versioner som är installerade, och jämför det mot kända sårbarheter.

Uppdatera till den senaste versionen så snart som möjligt. Om det inte finns en uppdatering som åtgärdar problemet bör du överväga att tillfälligt inaktivera tillägget, särskilt om sårbarheten har kritisk eller hög allvarlighetsgrad.

Newsletter – Send awesome emails from WordPress har över 200 000 aktiva installationer på WordPress.org och ett betyg på 4.6 av 5. Populära tillägg har generellt bättre säkerhetsrutiner tack vare större community och fler ögon på koden.