Extension WordPress
Vulnérabilités MailPoet Newsletters (Previous)
Cette page rassemble les failles publiées pour MailPoet Newsletters (Previous), leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de MailPoet Newsletters (Previous)
10 fiches
MailPoet Newsletters <= 2.8.1 – Spam Injection
An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks.
*-2.8.1
2.8.2
14/03/2018
MailPoet Newsletters <= 2.7.2 – SQL Injection
The MailPoet Newsletters plugin for WordPress is vulnerable to generic SQL Injection in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
*-2.7.2
2.7.3
11/09/2016
MailPoet Newsletters <= 2.7.2 – Reflected Cross-Site Scripting
The MailPoet Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'encodedForm' parameter in versions up to, and including, 2.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-2.7.2
2.7.3
10/09/2016
MailPoet Newsletters <= 2.6.19 – Reflected Cross-Site Scripting
The MailPoet Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wysija-key’ parameter in versions up to, and including, 2.6.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
[*, 2.7)
2.7
02/02/2016
MailPoet Newsletters (Previous) <= 2.6.10 – Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 for WordPress allows remote attackers to hijack the authentication of arbitrary users.
[*, 2.6.11)
2.6.11
21/09/2014
MailPoet Newsletters <= 2.6.7 – Authorization Bypass
Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.
*-2.6.7
2.6.8
21/09/2014
MailPoet Newsletters <= 2.6.6 – Arbitrary File Upload
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.
*-2.6.6
2.6.7
01/08/2014
MailPoet Newsletters <= 2.2 – Multiple SQL Injections
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using…
*-2.2
2.2.1
03/02/2013
MailPoet Newsletters (Previous) <= 2.1.6 – Cross-Site Scripting
The Wysija Newsletters plugin for WordPress is vulnerable to Cross-Site Scripting via the swfupload.swf applet in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
*-2.1.6
2.1.7
22/11/2012
SWFUpload <= 2.2.0.1 – Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter,…
*-2.1.6
2.1.7
09/11/2012
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.