Newsletter Manager

Newsletter Manager has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2020; 4 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2012 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (40%). Other recurring categories include Cross-Site Request Forgery (CSRF), Deserialization Of Untrusted Data.

4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2020.

3 independent researchers contributed these findings, most of them (2) reported by Heine Pedersen.

01234567891015.05.2012Today15.05.20126.1Newsletter Manager < 1.0.2 - Cross-Site Scripting via test_mail.php CVSS 6.1 · 15.05.20126.1Newsletter Manager < 1.0.2 - Cross-Site Scripting CVSS 6.1 · 15.05.201216.01.20148.8Newsletter Manager < 1.4 - Cross-Site Request Forgery CVSS 8.8 · 16.01.201418.05.20196.1Newsletter Manager <= 1.4 - Open Redirect CVSS 6.1 · 18.05.201929.12.20209.8Newsletter Manager <= 1.5.1 - Insecure Deserialization CVSS 9.8 · 29.12.2020

Strategic Overview

Avg CVSSHigh
7.4/ 10
Patch Coverage80%
Open

1

Fixed

4

Get automatic notifications for all Newsletter Manager vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2020-36727

Newsletter Manager <= 1.5.1 - Insecure Deserialization

Read the full analysis

Vulnerability Records

5 records
Showing 1–5 of 5 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C