Cross-Site Scripting
2 records40%First: 2012. Latest: 2012.
Plugin security history
Newsletter Manager Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 5 vulnerability records associated with Newsletter Manager, published between 2012 and 2020.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
5Total records
1Critical
1High
3Medium
0Low
0Informational
4Patched records
1Currently marked unpatched
2012-05-15First disclosure
2020-12-29Latest disclosure
4 of 5CVE coverage
Use this history
Check and watch Newsletter Manager.
A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2012 | 2 | |
| 2014 | 1 | |
| 2019 | 1 | |
| 2020 | 1 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 1 | 20% |
| High | 1 | 20% |
| Medium | 3 | 60% |
Vulnerability-Type Breakdown
Other
2 records40%First: 2019. Latest: 2020.
CSRF
1 record20%First: 2014. Latest: 2014.
Patch Status
- Patched
- 4
- Currently marked unpatched
- 1
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
1.51.41.0.2
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-1.5.1 | Newsletter Manager <= 1.5.1 - Insecure Deserialization | December 29, 2020 | Not supplied | Critical |
*-1.4 | Newsletter Manager <= 1.4 - Open Redirect | May 18, 2019 | 1.5 | Medium |
[*, 1.4) | Newsletter Manager < 1.4 - Cross-Site Request Forgery | January 16, 2014 | 1.4 | High |
[*, 1.0.2) | Newsletter Manager < 1.0.2 - Cross-Site Scripting | May 15, 2012 | 1.0.2 | Medium |
[*, 1.0.2) | Newsletter Manager < 1.0.2 - Cross-Site Scripting via test_mail.php | May 15, 2012 | 1.0.2 | Medium |
Selected source records
Latest Records
CriticalCVE-2020-36727
Newsletter Manager <= 1.5.1 - Insecure Deserialization
Published: December 29, 2020
- Affected versions
- *-1.5.1
- Patched versions
- Not supplied
Medium
Newsletter Manager <= 1.4 - Open Redirect
Published: May 18, 2019
- Affected versions
- *-1.4
- Patched versions
- 1.5
HighCVE-2012-6629
Newsletter Manager < 1.4 - Cross-Site Request Forgery
Published: January 16, 2014
- Affected versions
- [*, 1.4)
- Patched versions
- 1.4
MediumCVE-2012-6627
Newsletter Manager < 1.0.2 - Cross-Site Scripting via test_mail.php
Published: May 15, 2012
- Affected versions
- [*, 1.0.2)
- Patched versions
- 1.0.2
MediumCVE-2012-6628
Newsletter Manager < 1.0.2 - Cross-Site Scripting
Published: May 15, 2012
- Affected versions
- [*, 1.0.2)
- Patched versions
- 1.0.2
Highest-Severity Records
CriticalCVE-2020-36727
Newsletter Manager <= 1.5.1 - Insecure Deserialization
Published: December 29, 2020
- Affected versions
- *-1.5.1
- Patched versions
- Not supplied
HighCVE-2012-6629
Newsletter Manager < 1.4 - Cross-Site Request Forgery
Published: January 16, 2014
- Affected versions
- [*, 1.4)
- Patched versions
- 1.4
MediumCVE-2012-6627
Newsletter Manager < 1.0.2 - Cross-Site Scripting via test_mail.php
Published: May 15, 2012
- Affected versions
- [*, 1.0.2)
- Patched versions
- 1.0.2
Medium
Newsletter Manager <= 1.4 - Open Redirect
Published: May 18, 2019
- Affected versions
- *-1.4
- Patched versions
- 1.5
MediumCVE-2012-6628
Newsletter Manager < 1.0.2 - Cross-Site Scripting
Published: May 15, 2012
- Affected versions
- [*, 1.0.2)
- Patched versions
- 1.0.2
Currently Marked Unpatched Records
CriticalCVE-2020-36727
Newsletter Manager <= 1.5.1 - Insecure Deserialization
Published: December 29, 2020
- Affected versions
- *-1.5.1
- Patched versions
- Not supplied
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.