CVE-2026-119512: WordPress Newsletters plugin <= 4.18.2 - PHP Object Injection vulnerability
Published Nov 13, 2026
·Updated
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.2.
Affected Software
1 affected component
Tribulant Software Newsletters<=4.18.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.18.3
Event History
Nov 13, 2026
CVE Published
via MITRE·03:08 PM
Data Sourced
via MITRE·03:08 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness