Newsletter

Newsletter has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.4 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (50%). Other recurring categories include Open Redirect.

Every one of the 2 issues recorded for Newsletter has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Newsletter is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.8.17.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Newsletter vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.4CVE-2026-86823

Newsletter <= 9.3.6 - Unauthenticated Open Redirect

Read the full analysis

Vulnerability Records

2 records
Newsletter banner
Latestv2.4

Newsletter

s-feeds

Author

s-feeds

5.0(4)
100/100
Last Updated
2021-10-12 (5y ago)
Active Installs
10+
Downloads
8,527
Requires WP
3.0.1+
Requires PHP
0+
Tested up to
WP 5.8.17
Created
2015-10-29 (11y ago)

This plugin allows an “automatic” newsletter which means: You publish a post (as usual), and then we send out a notification to all your newsletter subscribers. That way they get to know about your new post, and come back to your website (increasing your traffic)! It’s very easy to set up. Simply install the newsletter plugin and place a subscription form (and subscription icons) on your website. Then people can subscribe to your newsletter and receive notifications by: Email (either one email per day or a single email for every published post) RSS News site Telegram Coming soon: WhatsApp, Browser push notifications and other delivery channels! For example, have a look at this sample subscription page. You can link to such a subscription page with a “follow” icon on your website. As you can see there, your newsletter subscribers have many options to specify which updates they want to receive, and how. Providing your visitors with more newsletter options means more subscribers for you! The plugin is powered by the newsletter service follow.it. The service can be used both in conjunction with, or as alternative to, mailing services like Mailchimp, Mailpoet, Aweber, Convertkit, Tinyletter, Sendinblue and many other email service providers. To get access to your newsletter subscribers, please “claim” your feed. You can do that directly in the plugin (third step). The newsletter service is FREE no matter how many subscribers you have (on the basic plan). Check out the (optional) Premium Features.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C