WordPress Vulnerability Scanner WPSec
Vulnerabilities / MailPoet – Newsletters, Email Marketing, and Automation

MailPoet – Newsletters, Email Marketing, and Automation vulnerabilities

Advisories WPSec published for MailPoet – Newsletters, Email Marketing, and Automation. Other sources may list more. Its attack surface: MailPoet – Newsletters, Email Marketing, and Automation on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-14 WPSEC-2026-0951 MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated Open Redirect via Tracked Link Shortcodes and Personalization Tags Medium 4.7 5.42.0
2026-10-14 WPSEC-2026-0950 MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated CAPTCHA Bypass via Answer Replay on Registration Forms Medium 5.3 5.42.0
2026-10-14 WPSEC-2026-0949 MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated Open Redirect via 'referrer_form_url' Parameter Medium 6.1 5.42.0
2026-10-07 WPSEC-2026-0500 MailPoet – Newsletters, Email Marketing, and Automation <= 5.40.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Newsletter Style Settings Medium 4.4 5.41.0
2026-10-07 WPSEC-2026-0499 MailPoet – Newsletters, Email Marketing, and Automation <= 5.40.0 - Unauthenticated Authentication Bypass via Brute-Forceable Subscriber Link Tokens Medium 4.8 5.41.0
2026-10-02 WPSEC-2026-0257 MailPoet – Newsletters, Email Marketing, and Automation <= 5.39.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title in 'newsletter:post_title' Shortcode Medium 6.4 5.40.0
2026-10-02 WPSEC-2026-0256 MailPoet – Newsletters, Email Marketing, and Automation <= 5.39.0 - Unauthenticated Sensitive Information Exposure of Password-Protected Post Content via Newsletters Low 3.7 5.40.0

License: CC BY 4.0