High
CVE-2026-16267
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 427
Reset filters
High
CVE-2026-16269
Newsletters <= 4.15 - Unauthenticated API Authorization Bypass via Type Juggling
Medium
CVE-2026-13362
SendPulse Email Marketing Newsletter <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post Meta
Medium
CVE-2026-18437
MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates
High
CVE-2026-16268
Newsletters <= 4.15 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-18436
MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint
Medium
CVE-2026-66703
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-12939
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
Medium
CVE-2026-12938
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
Medium
CVE-2026-59537
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-27064
Mailster - Email Newsletter Plugin for WordPress <= 4.1.17 - Authenticated (Editor+) Arbitrary File Upload
Medium
CVE-2026-65472
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.3.5 - Missing Authorization
Medium
CVE-2026-57626
MailPoet – Newsletters, Email Marketing, and Automation 5.30.0-5.33.0 - Cross-Site Request Forgery
Medium
CVE-2026-12918
Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter
High
CVE-2026-57715
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.1.7 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-57813
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.77.3 - Unauthenticated Privilege Escalation
Medium
CVE-2026-14342
Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter
Medium
CVE-2026-12170
AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute
High
CVE-2026-57410
MailerPress – Newsletter, email marketing & AI automation <= 2.0.2 - Authenticated (Contributor+) Privilege Escalation
High
CVE-2026-57394
Newsletters <= 4.14 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57389
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion
Medium
CVE-2026-57740
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.1 - Missing Authorization
High
CVE-2026-57739
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated SQL Injection
High
CVE-2026-57741
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.