ENL Newsletter

ENL Newsletter has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2024; none of them are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (50%). Other recurring categories include SQL Injection.

None of the 4 issues recorded for ENL Newsletter have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2014.

2 independent researchers contributed these findings, most of them (3) reported by Bob Matyas. ENL Newsletter is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 3.1.4.

01234567891009.10.2011Today28.05.20147.2ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection CVSS 7.2 · 28.05.201405.04.20244.3ENL Newsletter <= 1.0.1 - Cross-Site Request Forgery to Campaign Deletion CVSS 4.3 · 05.04.20246.1ENL Newsletter <= 1.0.1 - Cross-Site Request Forgery CVSS 6.1 · 05.04.202426.04.20249.1ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection CVSS 9.1 · 26.04.2024

Strategic Overview

Avg CVSSMedium
6.7/ 10
Patch Coverage0%
Open

4

Fixed

0

Get automatic notifications for all ENL Newsletter vulnerabilities before they are exploited.

Most severe open issueCVSS 9.1CVE-2024-3060

ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection

Read the full analysis

Vulnerability Records

4 records
Showing 1–4 of 4 reports
Plugin Profile
Latestv1.0.1

ENL Newsletter

wphobby

Author

wphobby

4.0(1)
80/100
Last Updated
2012-01-07 (15y ago)
Active Installs
10+
Downloads
6,271
Requires WP
3.0.1+
Requires PHP
0+
Tested up to
WP 3.1.4
Created
2011-10-09 (15y ago)

Main Features: Setup multiple newsletters according to the post categories. Different send modes include manual, weekly and monthly. Custom newsletter content, template and post count. Newsletter signup widget for user registration. Subscriber info list containing email, ip and registeration time. Import wordpress users to subscriber list. More info: Leave a comment

View on WordPress.org

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C