newsletters-lite vulnerabilities

CVEs whose affected-version data names the newsletters-lite package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

4 CVEsRSS

CVE-2026-116863Critical· 9.6

today

WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.

▾ MidnightTribulant Software · newsletters-litevia CVEORG

CVE-2026-111402Critical· 9.3

3d ago

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

▾ MidnightTribulant Software · newsletters-liteEPSS 0.35%via CVEORG

CVE-2026-94075Critical· 9.8

3d ago

WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

▾ MidnightTribulant Software · newsletters-liteEPSS 0.56%via CVEORG

CVE-2026-66619High· 7.6

1mo ago

Administrator SQL Injection in Newsletters <= 4.18 versions.

▾ TwilightTribulant Software · newsletters-liteEPSS 0.38%via NVD