Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-14787: WordPress Tribulant Newsletters plugin can run malicious code

CVE-2019-14787 · published 7 years ago

Summary

The Tribulant Newsletters add‑on for WordPress lets an attacker inject harmful script through a specific request to the admin interface. This could let a malicious user display unwanted content or steal information from visitors who use the compromised site. Update the plugin to version 4.6.19 or later, or remove it if you cannot apply the update.

What to do

Update tribulant newsletters to version 4.6.19 or later.

Affected software

Vendor	Product	Affected versions
tribulant	newsletters	< 4.6.19 `cpe:2.3:a:tribulant:newsletters::::::wordpress::*`

Original advisory text

The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.

References

https://wordpress.org/plugins/newsletters-lite/#developers Release Notes
https://wpvulndb.com/vulnerabilities/9447 Exploit Third Party Advisory
https://www.pluginvulnerabilities.com/2019/07/01/reflected-cross-site-scripting-... Exploit Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.4 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published9 Aug 2019

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2019-14787 · NVD

Track software like this

Free during beta