CVE-2022-1756
Newsletter < 7.4.5 - Reflected Cross-Site Scripting
- State
- Published
- Severity
- Not scored
- Published
- Jun 13, 2022
- Updated
- Aug 3, 2024
- Reserved
- May 17, 2022
Description
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
Scores
The record has no CVSS score.
Weaknesses
- CWE-79 Cross-site Scripting (XSS)
Affected Products
| Product | Versions |
|---|---|
Newsletter – Send awesome emails from WordPressUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.