7.2Hoch

CVE-2025-2009Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting

contrid Newsletters Veröffentlicht: 2025-03-26 11:21 (vor 1 Jahr)

Beschreibung

The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Schwachstellentyp (CWE): CWE-79

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
contrid	Newsletters	≤ 4.9.9.7

Referenzen und Patches

CVSS-Score

7.2Hoch

Quelle: Wordfence · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Geändert
Vertraulichkeit: Niedrig
Integrität: Niedrig
Verfügbarkeit: Keine

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Alle Scores (2)

cna	CVSS 3.1	7.2Hoch
security@wordfence.com	CVSS 3.1	7.2Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.35%

höher als 29 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: yes
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2025-03-05
Veröffentlicht2025-03-26 11:21
Bei IP-DB eingegangen2026-10-24 23:57
Zuletzt aktualisiert2026-06-17 12:06

Vergeben von (CNA): Wordfence
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

7.1Hoch

CVE-2026-119517 vor 1 Stunde

WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

VillaTheme Catna – Woo Name Your Price and Offers

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price an…

9.3Kritisch

CVE-2026-124415 vor 1 Stunde

WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Alejandro Alex Reservations

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

5.3Mittel

CVE-2026-125432 vor 1 Stunde

WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability

RelyWP reCAPTCHA for WooCommerce

Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.

8.5Hoch

CVE-2026-124265 vor 1 Stunde

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

Tribulant Software Newsletters

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

7.5Hoch

CVE-2026-124267 vor 1 Stunde

WordPress Gmail SMTP plugin <= 1.2.3.23 - Broken Access Control vulnerability

Noor Alam Gmail SMTP

Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.

7.1Hoch

CVE-2026-124410 vor 1 Stunde

WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua wplingua allows Stored XSS.This issue affects Translat…