contrid vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 20254
3. 20266

Newest CVEs

• CVE-2026-101325

  Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter

  contrid · Newsletters

  Medium5.3
• CVE-2026-75908

  Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter

  contrid · Newsletters

  Medium4.3
• CVE-2026-12939

  Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute

  contrid · Newsletters

  Medium6.4
• CVE-2026-12938

  Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

  contrid · Newsletters

  Medium6.4
• CVE-2026-2021

  Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute

  contrid · Slideshow Gallery LITE

  Medium6.4
• CVE-2026-3018

  Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter

  contrid · Newsletters

  High7.5
• CVE-2025-4857

  Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion

  contrid · Newsletters

  High7.2
• CVE-2025-3107

  Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter

  contrid · Newsletters

  Medium6.5
• CVE-2025-2009

  Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting

  contrid · Newsletters

  High7.2
• CVE-2024-13739

  Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter

  contrid · Newsletters

  Medium6.1