Unknown Newsletters vulnerabilities

7 CVEs affecting Unknown Newsletters, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16264, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16268, published 2026-08-06. High severity, CVSS 8.2. EPSS: 0.7% chance of exploitation in the next 30 days. The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers…
CVE-2026-12583, published 2026-07-14. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and,…
CVE-2026-16267, published 2026-08-08. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject…
CVE-2026-16269, published 2026-08-08. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform…
CVE-2026-16264, published 2026-09-23. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on…
CVE-2026-17520, published 2026-08-29. Medium severity, CVSS 4.8. EPSS: 0.1% chance of exploitation in the next 30 days. The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute…
CVE-2026-17522, published 2026-08-29. Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days. The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options,…