Ccontrid

Products

Exploited and recent CVEs

• CVE-2026-101325 Medium 5.3 Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter 0.3%
• CVE-2026-75908 Medium 4.3 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter 0.4%
• CVE-2026-12939 Medium 6.4 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute 0.3%
• CVE-2026-12938 Medium 6.4 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute 0.3%
• CVE-2026-2021 Medium 6.4 Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute 0.2%
• CVE-2026-3018 High 7.5 Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter 1.4%
• CVE-2025-4857 High 7.2 Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion 0.8%
• CVE-2025-3107 Medium 6.5 Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter 0.4%
• CVE-2025-2009 High 7.2 Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting 0.4%
• CVE-2024-13739 Medium 6.1 Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter 0.3%
• CVE-2024-10181 Medium 6.4 Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode 0.4%
• CVE-2024-8247 High 8.8 Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation 0.5%
• CVE-2024-7411 Medium 5.3 Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure 0.4%
• CVE-2024-5543 High 8.1 Slideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injection 0.5%