CVE-2023-27922

CVE-2023-27922: vulnerability in Stefano Lissa & The Newsletter Team Newsletter

Published · Updated

Follow this CVE+ Monitor Newsletter

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 1.2%
Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary script.
Affected products
Stefano Lissa & The Newsletter Team · Newsletter
Related CVEs — Stefano Lissa & The Newsletter Team Newsletter

In the same product, most dangerous first.

CVE-2024-30522MEDIUMWordPress Newsletter plugin <= 8.2.0 - IP Blacklist Bypass vulnerabilityEPSS 0.5%CVE-2024-31434MEDIUMWordPress Newsletter plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%