Latest vulnerabilities for vendor "mailerlite"

Where

Sort:

Software

mailerlite mailerlite – woocommerce integration

mailerlite signup forms

mailerlite

mailerlite mailerlite

mailerlite mailerlite signup forms wordpress

mailerlite mailerlite wordpress

mailerlite mailerlite – signup forms (official)

MailerLite MailerLite – Signup forms (official)MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

Risk 22

Severity

4.3

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.

First published (updated )

CVE-2026-3253

MailerLite MailerLiteWordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability

Risk 16

Severity

4.3

EPSS

0.04%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.

First published (updated )

CVE-2026-25420

MailerLite Signup formsMailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting

Risk 33

Severity

5.5

XSS

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formdescription' and 'successmessage' parameters in versions up to, and including, 1.7.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

First published (updated )

CVE-2025-13993

MailerLite MailerLite – WooCommerce integrationWordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerability

Risk 22

Severity

4.3

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Missing Authorization vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.

Remedy

Update to 2.0.9 or a higher version.

First published (updated )

CVE-2023-52227

MailerLite Signup formsXSS

Risk 39

Severity

6.4

XSS

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions 1.5.0 to 1.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

First published (updated )

CVE-2024-1386

MailerLite MailerLite – WooCommerce integrationWordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Risk 77

Severity

8.8

CSRF

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.

Remedy

Update to 2.0.9 or a higher version.

First published (updated )

CVE-2023-52223

MailerLite Mailerlite Signup Forms WordpressWordPress MailerLite – Signup forms (official) plugin <= 1.5.7 - Cross-Site Request Forgery (CSRF) vulnerability

Risk 77

Severity

8.8

CSRF

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.

Remedy

Update to 1.5.8 or higher version.

First published (updated )

CVE-2022-33201

MailerLite Mailerlite Signup Forms WordpressMailerLite < 1.5.4 - Reflected Cross-Site Scripting

Risk 38

Severity

6.1

XSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

First published (updated )

CVE-2022-1604

Trending

Vendor Risk Score

Software

MailerLite MailerLite – Signup forms (official)MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

MailerLite MailerLiteWordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability

MailerLite Signup formsMailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting

MailerLite MailerLite – WooCommerce integrationWordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerability

Remedy

MailerLite Signup formsXSS

MailerLite MailerLite – WooCommerce integrationWordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Remedy

MailerLite Mailerlite Signup Forms WordpressWordPress MailerLite – Signup forms (official) plugin <= 1.5.7 - Cross-Site Request Forgery (CSRF) vulnerability

Remedy

MailerLite Mailerlite Signup Forms WordpressMailerLite < 1.5.4 - Reflected Cross-Site Scripting

Company

Resources

Contact