MailPoet Newsletters (Previous)

MailPoet Newsletters (Previous) has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2018; all 10 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2016 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (40%). Other recurring categories include SQL Injection, Authorization Bypass Through User-Controlled Key.

Every one of the 10 issues recorded for MailPoet Newsletters (Previous) has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all MailPoet Newsletters (Previous) vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2014-4725

MailPoet Newsletters <= 2.6.6 - Arbitrary File Upload

Read the full analysis

Vulnerability Records

10 records


2018-03-14 00:00	MailPoet Newsletters <= 2.8.1 - Spam Injection MailPoet Newsletters (Previous) <= 2.8.1	`CVE-2018-20853`	5.3 Medium	Anonymous	Yes
2016-09-11 00:00	MailPoet Newsletters <= 2.7.2 - SQL Injection MailPoet Newsletters (Previous) <= 2.7.2	`N/A`	6.5 Medium	Anonymous	Yes
2016-09-10 00:00	MailPoet Newsletters <= 2.7.2 - Reflected Cross-Site Scripting MailPoet Newsletters (Previous) <= 2.7.2	`N/A`	6.5 Medium	Sipke Mellema	Yes
2016-02-02 00:00	MailPoet Newsletters <= 2.6.19 - Reflected Cross-Site Scripting MailPoet Newsletters (Previous) < 2.7	`N/A`	6.1 Medium	Omar Kurt	Yes
2014-09-21 00:00	MailPoet Newsletters <= 2.6.7 - Authorization Bypass MailPoet Newsletters (Previous) <= 2.6.7	`CVE-2014-4726`	7.3 High	Dominic	Yes
2014-09-21 00:00	MailPoet Newsletters (Previous) <= 2.6.10 - Cross-Site Request Forgery MailPoet Newsletters (Previous) < 2.6.11	`CVE-2014-3907`	6.3 Medium	Yoshinori Matsumoto	Yes
2014-08-01 00:00	MailPoet Newsletters <= 2.6.6 - Arbitrary File Upload MailPoet Newsletters (Previous) <= 2.6.6	`CVE-2014-4725`	9.8 Critical	Sucuri Research Team	Yes
2013-02-03 00:00	MailPoet Newsletters <= 2.2 - Multiple SQL Injections MailPoet Newsletters (Previous) <= 2.2	`CVE-2013-1408`	7.2 High	High-Tech Bridge Security Research Lab	Yes
2012-11-22 00:00	MailPoet Newsletters (Previous) <= 2.1.6 - Cross-Site Scripting MailPoet Newsletters (Previous) <= 2.1.6	`N/A`	6.1 Medium	Ryan Dewhurst	Yes
2012-11-09 20:12	SWFUpload <= 2.2.0.1 - Cross-Site Scripting MailPoet Newsletters (Previous) <= 2.1.6	`CVE-2012-3414`	6.1 Medium	Neal Poole	Yes

Showing 1–10 of 10 reports