Tribulant Software has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 9.4 (critical), with 3 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.4
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-94075Critical· 9.8WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability54CVE-2026-116863Critical· 9.6WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability53CVE-2026-111402Critical· 9.3WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability51CVE-2026-66619High· 7.6Administrator SQL Injection in Newsletters <= 4.18 versions.42
Tribulant Software vulnerabilities
CVEs affecting Tribulant Software, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-116863Critical· 9.6WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.
CVE-2026-111402Critical· 9.3WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
CVE-2026-94075Critical· 9.8WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
CVE-2026-66619High· 7.6Administrator SQL Injection in Newsletters <= 4.18 versions.
Administrator SQL Injection in Newsletters <= 4.18 versions.