PLUGIN SECURITY
Is Newsletter safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Newsletter WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
newsletter - Requires PHP: 7.0+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
- Newsletter – Send awesome emails from WordPress [newsletter] < 6.8.2 [CVE-2020-35932, Newsletter <= 6.8.1 - Authenticated PHP Object Injection, Newsletter < 6.8.2 - Authenticated PHP Object Injection]
- Newsletter – Send awesome emails from WordPress [newsletter] < 6.8.2 [CVE-2020-35933, WordPress Newsletter plugin <= 6.8.1 - Authenticated Cross-Site Scripting (XSS) vulnerability, Newsletter <= 6.8.1 - Reflected Cross-Site Scripting, Newsletter < 6.8.2 - Authenticated Cross-Site Scripting (XSS)]
- Newsletter – Send awesome emails from WordPress [newsletter] < 6.5.4 [WordPress Newsletter plugin <= 6.5.3 - CSV Injection vulnerability]
- Newsletter – Send awesome emails from WordPress [newsletter] < 6.7.7 [WordPress Newsletter plugin <= 6.7.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability]
- Newsletter – Send awesome emails from WordPress [newsletter] < 7.4.5 [CVE-2022-1756, WordPress Newsletter plugin <= 7.4.4 - Reflected Cross-Site Scripting (XSS) vulnerability, WordPress Plugin "Newsletter" vulnerable to cross-site scripting, Newsletter – Send awesome emails from WordPress <= 7.4.4 - Reflected Cross-Site Scripting, Newsletter < 7.4.5 - Reflected Cross-Site Scripting]
+ 28 more known vulnerabilities
- Newsletter – Send awesome emails from WordPress [newsletter] < 3.0.9 [WordPress Newsletter Plugin <= 3.0.8 - SQL Injection]
- Newsletter – Send awesome emails from WordPress [newsletter] < 3.2.7 [WordPress Newsletter Plugin <= 3.2.6 - Cross Site Scripting]
- Newsletter – Send awesome emails from WordPress [newsletter] < 7.4.5 [WordPress Newsletter plugin <= 7.4.4 - Reflected Cross-Site Scripting (XSS) vulnerability]
- Newsletter – Send awesome emails from WordPress [newsletter] < 7.4.6 [CVE-2022-1889, Newsletter <= 7.4.5 - Authenticated (Admin+) Stored Cross-Site Scripting, Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting]
- Newsletter – Send awesome emails from WordPress [newsletter] < 3.8.3 [WordPress Newsletter Plugin <= 3.7.0 - Open Redirection]
- Newsletter – Send awesome emails from WordPress [newsletter] < 6.7.7 [Newsletter <= 6.7.6 - Stored Cross-Site Scripting]
- Newsletter – Send awesome emails from WordPress [newsletter] < 6.5.4 [Newsletter <= 6.5.3 - CSV Injection]
- Newsletter – Send awesome emails from WordPress [newsletter] < 3.8.3 [Newsletter <= 3.8.2 - Open Redirect]
- Newsletter – Send awesome emails from WordPress [newsletter] < 3.2.7 [Newsletter <= 3.2.6 - Reflected Cross-Site Scripting]
- Newsletter – Send awesome emails from WordPress [newsletter] < 7.6.9 [Newsletter <= 7.6.8 - Reflected Cross-Site Scripting]
- Newsletter – Send awesome emails from WordPress [newsletter] < 7.6.9 [WordPress Newsletter Plugin <= 7.6.8 is vulnerable to Cross Site Scripting (XSS)]
- Newsletter – Send awesome emails from WordPress [newsletter] < 7.6.9 [CVE-2023-27922, WordPress Plugin "Newsletter" vulnerable to cross-site scripting, Newsletter < 7.6.9 - Reflected XSS]
- Newsletter – Send awesome emails from WordPress [newsletter] < 6.7.7 [Newsletter < 6.7.7 - Authenticated Stored Cross-Site Scripting]
- Newsletter – Send awesome emails from WordPress [newsletter] < 6.5.4 [Newsletter < 6.5.4 - CSV Injection]
- Newsletter – Send awesome emails from WordPress [newsletter] < 3.8.3 [Newsletter 3.7.0 - Open Redirect]
- Newsletter – Send awesome emails from WordPress [newsletter] < 3.2.7 [Newsletter < 3.2.7 - Cross-Site Scripting (XSS)]
- Newsletter – Send awesome emails from WordPress [newsletter] < 3.0.9 [Newsletter < 3.0.9 - SQL Injection]
- Newsletter – Send awesome emails from WordPress [newsletter] < 7.9.0 [CVE-2023-4772, Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode, WordPress Email Newsletter Plugin <= 7.8.9 is vulnerable to Cross Site Scripting (XSS), Newsletter < 7.9.0 - Contributor+ Stored XSS]
- Newsletter – Send awesome emails from WordPress [newsletter] < 8.0.7 [Newsletter <= 8.0.6 - Cross-Site Request Forgery]
- Newsletter – Send awesome emails from WordPress [newsletter] < 8.2.1 [CVE-2024-30522, WordPress Newsletter Plugin <= 8.2.0 is vulnerable to Bypass Vulnerability, Newsletter <= 8.2.0 - IP Spoofing, Newsletter < 8.2.1 - IP Spoofing]
- Newsletter – Send awesome emails from WordPress [newsletter] < 8.0.7 [CVE-2024-31434, WordPress Newsletter Plugin <= 8.0.6 is vulnerable to Cross Site Request Forgery (CSRF), Newsletter <= 8.0.6 - Cross-Site Request Forgery]
- Newsletter – Send awesome emails from WordPress [newsletter] < 8.3.5 [CVE-2024-5317, Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1, WordPress Newsletter Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)]
- Newsletter – Send awesome emails from WordPress [newsletter] < 8.7.1 [Newsletter < 8.7.1 - Admin+ Stored XSS, WordPress Newsletter Plugin < 8.7.1 is vulnerable to Cross Site Scripting (XSS), EUVD-2025-13319, Newsletter <= 8.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting]
- Newsletter – Send awesome emails from WordPress [newsletter] < 8.8.2 [CVE-2025-3584, Newsletter <= 8.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting, EUVD-2025-16699]
- Newsletter – Send awesome emails from WordPress [newsletter] < 9.1.0 [CVE-2025-67999, Newsletter <= 9.0.9 - Authenticated (Administrator+) SQL Injection]
- Newsletter – Send awesome emails from WordPress [newsletter] < 9.1.1 [CVE-2026-1051, Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription]
- Newsletter – Send awesome emails from WordPress [newsletter] < 8.8.5 [Newsletter < 8.8.5 - Admin+ Stored XSS via Form, Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting, EUVD-2025-17434]
- Newsletter – Send awesome emails from WordPress [newsletter] < 8.8.5 [Newsletter < 8.8.5 - Admin+ Stored XSS via Widget, Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting, EUVD-2025-17435]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- Hostinger Reach – AI-Powered Email Marketing for WordPress — 1000000+ active installs — max PHP 8.4
- MC4WP: Mailchimp for WordPress — 1000000+ active installs — max PHP 8.4
- MailPoet – Newsletters, Email Marketing, and Automation — 500000+ active installs
- Brevo – Email, SMS, Web Push, Chat, and more. — 100000+ active installs — max PHP 8.4
- Newsletters, Email Marketing, SMS and Popups by Omnisend — 100000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.