enl_newsletter_plugin_project CVEs

Beta · best-effort

4 CVEs tagged to vendor enl_newsletter_plugin_project — 0 Critical, 0 High, 4 Medium, 0 Low, 0 Unrated.

See this archive with more filters View vendor evidence profile Explore

CVE-2024-3060

Published Apr 26, 2024

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks

CVSS 4.5 · Medium

Vendor/product tagsBeta · best-effort

CVE-2024-3059

Published Apr 26, 2024

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a C…

CVSS 5.7 · Medium

Vendor/product tagsBeta · best-effort

CVE-2024-3058

Published Apr 26, 2024

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make log…

CVSS 5.4 · Medium

Vendor/product tagsBeta · best-effort

CVE-2014-4939

Published Jul 11, 2014

SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the…

CVSS 6.5 · Medium

Vendor/product tagsBeta · best-effort

Showing 1-4 of 4 CVEsPage 1 of 1