Newsletters, Email Marketing, SMS and Popups by Omnisend

Newsletters, Email Marketing, SMS and Popups by Omnisend has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (100%).

The one issue recorded for Newsletters, Email Marketing, SMS and Popups by Omnisend has a vendor fix available, so running the current release closes it.

All of these findings were reported by elaprendiz1927. Newsletters, Email Marketing, SMS and Popups by Omnisend is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Newsletters, Email Marketing, SMS and Popups by Omnisend vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2026-97074

Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference

Read the full analysis

Vulnerability Records

1 records
Newsletters, Email Marketing, SMS and Popups by Omnisend banner
Latestv1.9.1

Newsletters, Email Marketing, SMS and Popups by Omnisend

Omnisend

Author

Omnisend

4.8(16)
96/100
Last Updated
2026-09-24 (25d ago)
Active Installs
100,000+
Downloads
945,567
Requires WP
4.7.0+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2024-01-30 (3y ago)

POWERFUL, YET INTUITIVE EMAIL MARKETING, NEWSLETTER, SMS MARKETING & AUTOMATION PLUGIN FOR YOUR WORDPRESS WEBSITE. IF YOU USE WOOCOMMERCE TO SELL STUFF ONLINE, CLICK HERE TO DOWNLOAD OUR PLUGIN BUILT SPECIFICALLY FOR WOOCOMMERCE. Email Marketing by Omnisend turns your WordPress website visitors into subscribers, then keeps them reading. More than 150,000 brands worldwide use it to run signup forms and landing pages, send newsletters, manage their audience, and text when email isn’t the right channel. Whether you’re a blogger, an event organizer, or a small business owner, it all runs from your WordPress dashboard. Free to start, no credit card needed. Some of the features of Omnisend include: Email campaigns & newsletters Build emails and newsletters in a drag-and-drop editor, with 250+ templates to start from Send or schedule emails for a future date and time, and track your results in real time Segment and target your campaigns on behavior, demographics, signup source, and more Test different subject lines, content, and designs to see what works best for your audience Get detailed reporting on how many people opened, clicked, and converted Set up automated campaigns that trigger on subscriber behavior: welcome new subscribers, send birthday messages, follow up on form submissions, and more Omnisend AI — on every plan, free included Generate email copy, subject lines, and preheaders in your brand’s voice Get suggestions for grammar, tone, and style while you edit Translate or adjust the tone of a draft without rewriting it Describe an audience in plain words, and AI builds the segment Connect ChatGPT or Claude with Omnisend MCP, then check performance and draft campaigns in one conversation Integrated opt-in forms Create popups, signup boxes, and landing pages right from Omnisend Use our integrations with popular form builders, such as Contact Form 7, Formidable Forms, Gravity Forms, and Ninja Forms Describe the form you want and Forms AI Assistant builds the layout, copy, and design (paid plans) Segment your subscribers based on different form submissions or submitted data SMS marketing Collect phone numbers and consent with customizable opt-in forms Set up and send SMS campaigns from $0.007 per message See how many people read, clicked, and converted from your texts Built-in analytics & dashboards See how your signup forms perform right from the Omnisend dashboard with graphs, charts, and data widgets Track every marketing email and signup to get detailed metrics Even more features Turn your website visitors into subscribers with website signup forms Double opt-in for better list quality Spot contacts going quiet and adjust your emails before they’re gone Fully GDPR ready Omnisend is a self-hosted WordPress plugin. You own your data, and it is protected with the latest security standards. Our plugin is fully GDPR compliant, so you can be confident that your customers’ data is being collected and used in a responsible way. Support, 24/7 Live chat and email support on every plan, including free, in six languages, answering in about four minutes. There’s a Help Center too, if you’d rather sort it out yourself. Drive engagement with Omnisend Omnisend is an email marketing plugin designed to help you drive engagement. Founded in 2014 as Soundest, it’s been a top choice for marketers across the globe for over 10 years. From day one, we made it our priority to put marketers at the center of every decision we’d make — and that hasn’t changed at all. REQUIREMENTS None.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C