Vulnerability history

Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Admin+ Stored XSS vulnerability

Sensitive Information Exposure via Imported Subscribers CSV File vulnerability

Missing Authorization and Nonce Exposure vulnerability

Missing Authorization in Multiple AJAX Actions vulnerability

Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS vulnerability

Cross Site Scripting (XSS) vulnerability

Admin+ SSRF & File Read vulnerability

Unauthenticated Stored XSS vulnerability

Admin+ Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery (CSRF) leading to plugin settings update

Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change

SQL Injection (SQLi) vulnerability to Reflected Cross-Site Scripting (XSS)

Local File Inclusion (LFI) leading to Remote Code Execution (RCE)

SQL Injection (SQLi) vulnerability

Authenticated Local File Inclusion (LFI) vulnerability

Authenticated Deleting/Importing Subscribers vulnerability

Authenticated Newsletter Send With Custom Content And Sender vulnerability

Multiple Stored Cross-Site Scripting (XSS) vulnerabilities

SQL injection (SQLi) vulnerability

SQL Injection (SQLi) vulnerability