MidnightBSD

Advisories for mailpoet

CVE-2014-3907 MEDIUM

Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 for WordPress allows remote attackers to hijack the authentication of arbitrary users.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,

Products Affected

Vendor Product Version
mailpoet mailpoet_newsletters 2.4
mailpoet mailpoet_newsletters 0.9
mailpoet mailpoet_newsletters 2.0.3
mailpoet mailpoet_newsletters 2.6.8
mailpoet mailpoet_newsletters 1.1.3
mailpoet mailpoet_newsletters 2.6.5
mailpoet mailpoet_newsletters 2.6.6
mailpoet mailpoet_newsletters 2.5.7
mailpoet mailpoet_newsletters 1.1.1
mailpoet mailpoet_newsletters 2.5.1
mailpoet mailpoet_newsletters 2.1.7
mailpoet mailpoet_newsletters 2.5.9.1
mailpoet mailpoet_newsletters 2.1.1
mailpoet mailpoet_newsletters 2.3
mailpoet mailpoet_newsletters 2.6
mailpoet mailpoet_newsletters 2.6.3
mailpoet mailpoet_newsletters 2.3.4
mailpoet mailpoet_newsletters 2.5.8
mailpoet mailpoet_newsletters 2.3.2
mailpoet mailpoet_newsletters 2.4.4
mailpoet mailpoet_newsletters 2.5.9
mailpoet mailpoet_newsletters 2.6.7
mailpoet mailpoet_newsletters 2.1.3
mailpoet mailpoet_newsletters 1.0
mailpoet mailpoet_newsletters 2.5.9.4
mailpoet mailpoet_newsletters 1.1.4
mailpoet mailpoet_newsletters 2.2.2
mailpoet mailpoet_newsletters 2.1.4
mailpoet mailpoet_newsletters 2.3.5
mailpoet mailpoet_newsletters 0.9.6
mailpoet mailpoet_newsletters 2.6.2
mailpoet mailpoet_newsletters 2.6.4
mailpoet mailpoet_newsletters 1.1.5
mailpoet mailpoet_newsletters 2.0.1
mailpoet mailpoet_newsletters 2.5.9.2
mailpoet mailpoet_newsletters 2.0.6
mailpoet mailpoet_newsletters 2.1.2
mailpoet mailpoet_newsletters 2.1.6
mailpoet mailpoet_newsletters 2.0.9.5
mailpoet mailpoet_newsletters 2.0.8
mailpoet mailpoet_newsletters *
mailpoet mailpoet_newsletters 2.4.3
mailpoet mailpoet_newsletters 2.5.5
mailpoet mailpoet_newsletters 1.1.2
mailpoet mailpoet_newsletters 2.4.1
mailpoet mailpoet_newsletters 2.0
mailpoet mailpoet_newsletters 2.3.1
mailpoet mailpoet_newsletters 2.1.5
mailpoet mailpoet_newsletters 0.9.1
mailpoet mailpoet_newsletters 1.0.1
mailpoet mailpoet_newsletters 1.1
mailpoet mailpoet_newsletters 2.0.9
mailpoet mailpoet_newsletters 2.5.9.3
mailpoet mailpoet_newsletters 2.1.8
mailpoet mailpoet_newsletters 0.9.2
mailpoet mailpoet_newsletters 2.2.3
mailpoet mailpoet_newsletters 2.5
mailpoet mailpoet_newsletters 2.5.4
mailpoet mailpoet_newsletters 2.0.5
mailpoet mailpoet_newsletters 2.6.1
mailpoet mailpoet_newsletters 2.0.2
mailpoet mailpoet_newsletters 2.2
mailpoet mailpoet_newsletters 2.0.4
mailpoet mailpoet_newsletters 2.0.7
mailpoet mailpoet_newsletters 2.1
mailpoet mailpoet_newsletters 2.1.9
mailpoet mailpoet_newsletters 2.5.2
mailpoet mailpoet_newsletters 2.5.3
mailpoet mailpoet_newsletters 2.4.2
mailpoet mailpoet_newsletters 2.2.1
mailpoet mailpoet_newsletters 2.3.3
mailpoet mailpoet_newsletters 2.6.9
CVE-2014-4725 HIGH

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-287,

Products Affected

Vendor Product Version
mailpoet mailpoet_newsletters 2.4
mailpoet mailpoet_newsletters 0.9
mailpoet mailpoet_newsletters 2.0.3
mailpoet mailpoet_newsletters 1.1.3
mailpoet mailpoet_newsletters 2.6.5
mailpoet mailpoet_newsletters 2.5.7
mailpoet mailpoet_newsletters 1.1.1
mailpoet mailpoet_newsletters 2.5.1
mailpoet mailpoet_newsletters 2.1.7
mailpoet mailpoet_newsletters 2.5.9.1
mailpoet mailpoet_newsletters 2.1.1
mailpoet mailpoet_newsletters 2.3
mailpoet mailpoet_newsletters 2.6
mailpoet mailpoet_newsletters 2.6.3
mailpoet mailpoet_newsletters 2.3.4
mailpoet mailpoet_newsletters 2.5.8
mailpoet mailpoet_newsletters 2.3.2
mailpoet mailpoet_newsletters 2.4.4
mailpoet mailpoet_newsletters 2.5.9
mailpoet mailpoet_newsletters 2.1.3
mailpoet mailpoet_newsletters 1.0
mailpoet mailpoet_newsletters 2.5.9.4
mailpoet mailpoet_newsletters 1.1.4
mailpoet mailpoet_newsletters 2.2.2
mailpoet mailpoet_newsletters 2.1.4
mailpoet mailpoet_newsletters 2.3.5
mailpoet mailpoet_newsletters 0.9.6
mailpoet mailpoet_newsletters 2.6.2
mailpoet mailpoet_newsletters 2.6.4
mailpoet mailpoet_newsletters 1.1.5
mailpoet mailpoet_newsletters 2.0.1
mailpoet mailpoet_newsletters 2.5.9.2
mailpoet mailpoet_newsletters 2.0.6
mailpoet mailpoet_newsletters 2.1.2
mailpoet mailpoet_newsletters 2.1.6
mailpoet mailpoet_newsletters 2.0.9.5
mailpoet mailpoet_newsletters 2.0.8
mailpoet mailpoet_newsletters *
mailpoet mailpoet_newsletters 2.4.3
mailpoet mailpoet_newsletters 2.5.5
mailpoet mailpoet_newsletters 1.1.2
mailpoet mailpoet_newsletters 2.4.1
mailpoet mailpoet_newsletters 2.0
mailpoet mailpoet_newsletters 2.3.1
mailpoet mailpoet_newsletters 2.1.5
mailpoet mailpoet_newsletters 0.9.1
mailpoet mailpoet_newsletters 1.0.1
mailpoet mailpoet_newsletters 1.1
mailpoet mailpoet_newsletters 2.0.9
mailpoet mailpoet_newsletters 2.5.9.3
mailpoet mailpoet_newsletters 2.1.8
mailpoet mailpoet_newsletters 0.9.2
mailpoet mailpoet_newsletters 2.2.3
mailpoet mailpoet_newsletters 2.5
mailpoet mailpoet_newsletters 2.5.4
mailpoet mailpoet_newsletters 2.0.5
mailpoet mailpoet_newsletters 2.6.1
mailpoet mailpoet_newsletters 2.0.2
mailpoet mailpoet_newsletters 2.2
mailpoet mailpoet_newsletters 2.0.4
mailpoet mailpoet_newsletters 2.0.7
mailpoet mailpoet_newsletters 2.1
mailpoet mailpoet_newsletters 2.1.9
mailpoet mailpoet_newsletters 2.5.2
mailpoet mailpoet_newsletters 2.5.3
mailpoet mailpoet_newsletters 2.4.2
mailpoet mailpoet_newsletters 2.2.1
mailpoet mailpoet_newsletters 2.3.3
CVE-2014-4726 HIGH

Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

CVSS 2.0

Severity: HIGH

Problem Type: NVD-CWE-noinfo,

Products Affected

Vendor Product Version
mailpoet mailpoet_newsletters 2.4
mailpoet mailpoet_newsletters 0.9
mailpoet mailpoet_newsletters 2.0.3
mailpoet mailpoet_newsletters 1.1.3
mailpoet mailpoet_newsletters 2.6.5
mailpoet mailpoet_newsletters 2.6.6
mailpoet mailpoet_newsletters 2.5.7
mailpoet mailpoet_newsletters 1.1.1
mailpoet mailpoet_newsletters 2.5.1
mailpoet mailpoet_newsletters 2.1.7
mailpoet mailpoet_newsletters 2.5.9.1
mailpoet mailpoet_newsletters 2.1.1
mailpoet mailpoet_newsletters 2.3
mailpoet mailpoet_newsletters 2.6
mailpoet mailpoet_newsletters 2.6.3
mailpoet mailpoet_newsletters 2.3.4
mailpoet mailpoet_newsletters 2.5.8
mailpoet mailpoet_newsletters 2.3.2
mailpoet mailpoet_newsletters 2.4.4
mailpoet mailpoet_newsletters 2.5.9
mailpoet mailpoet_newsletters 2.1.3
mailpoet mailpoet_newsletters 1.0
mailpoet mailpoet_newsletters 2.5.9.4
mailpoet mailpoet_newsletters 1.1.4
mailpoet mailpoet_newsletters 2.2.2
mailpoet mailpoet_newsletters 2.1.4
mailpoet mailpoet_newsletters 2.3.5
mailpoet mailpoet_newsletters 0.9.6
mailpoet mailpoet_newsletters 2.6.2
mailpoet mailpoet_newsletters 2.6.4
mailpoet mailpoet_newsletters 1.1.5
mailpoet mailpoet_newsletters 2.0.1
mailpoet mailpoet_newsletters 2.5.9.2
mailpoet mailpoet_newsletters 2.0.6
mailpoet mailpoet_newsletters 2.1.2
mailpoet mailpoet_newsletters 2.1.6
mailpoet mailpoet_newsletters 2.0.9.5
mailpoet mailpoet_newsletters 2.0.8
mailpoet mailpoet_newsletters *
mailpoet mailpoet_newsletters 2.4.3
mailpoet mailpoet_newsletters 2.5.5
mailpoet mailpoet_newsletters 1.1.2
mailpoet mailpoet_newsletters 2.4.1
mailpoet mailpoet_newsletters 2.0
mailpoet mailpoet_newsletters 2.3.1
mailpoet mailpoet_newsletters 2.1.5
mailpoet mailpoet_newsletters 0.9.1
mailpoet mailpoet_newsletters 1.0.1
mailpoet mailpoet_newsletters 1.1
mailpoet mailpoet_newsletters 2.0.9
mailpoet mailpoet_newsletters 2.5.9.3
mailpoet mailpoet_newsletters 2.1.8
mailpoet mailpoet_newsletters 0.9.2
mailpoet mailpoet_newsletters 2.2.3
mailpoet mailpoet_newsletters 2.5
mailpoet mailpoet_newsletters 2.5.4
mailpoet mailpoet_newsletters 2.0.5
mailpoet mailpoet_newsletters 2.6.1
mailpoet mailpoet_newsletters 2.0.2
mailpoet mailpoet_newsletters 2.2
mailpoet mailpoet_newsletters 2.0.4
mailpoet mailpoet_newsletters 2.0.7
mailpoet mailpoet_newsletters 2.1
mailpoet mailpoet_newsletters 2.1.9
mailpoet mailpoet_newsletters 2.5.2
mailpoet mailpoet_newsletters 2.5.3
mailpoet mailpoet_newsletters 2.4.2
mailpoet mailpoet_newsletters 2.2.1
mailpoet mailpoet_newsletters 2.3.3
CVE-2018-20853 MEDIUM

An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks.

CVSS 3.x

Source Score Severity Vector Exploitability Impact
nvd@nist.gov 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N 3.9 1.4

CVSS 2.0

Severity: MEDIUM

Problem Type: NVD-CWE-noinfo,

Products Affected

Vendor Product Version
mailpoet mailpoet_newsletters *
CVE-2019-11843 MEDIUM

The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).

CVSS 3.x

Source Score Severity Vector Exploitability Impact
nvd@nist.gov 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 2.8 2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor Product Version
mailpoet mailpoet *