CVE-2022-1756
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2022
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Newsletter < 7.4.5 - Reflected Cross-Site Scripting
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Newsletter – Send awesome emails from WordPress
- Vendor
- Unknown
- Product
- Newsletter – Send awesome emails from WordPress
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 7.4.5 | affected | custom | 7.4.5 | Unavailable | None listed |