blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2023-0766

HIGH 8.8 CVSS 3.1
Published
May 30, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce.

Affected products and versions

  • Unknown Newsletter Popup — Up to and including 1.2
  • newsletter_popup_project newsletter_popup — Up to and including 1.2

References

  • wpscan.com https://wpscan.com/vulnerability/90a1976c-0348-41ea-90b4-f7a5d9306c88 Exploit
  • nvd.nist.gov Official NVD record