Pressified Sendpress — known CVE vulnerabilities

Every CVE whose affected-product data names Pressified Sendpress, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (8)

• CVE-2015-9448 — CVSS 8.8 (high): The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.
• CVE-2023-47517 — CVSS 7.1 (high): Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.23.11.6 versions.
• CVE-2024-1588 — CVSS 6.8 (medium): The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high…
• CVE-2023-5660 — CVSS 6.4 (medium): The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions…
• CVE-2024-1589 — CVSS 6.1 (medium): The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high…
• CVE-2023-41729 — CVSS 5.9 (medium): Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions.
• CVE-2023-35040 — CVSS 5.3 (medium): Missing Authorization vulnerability in SendPress SendPress Newsletters.This issue affects SendPress Newsletters: from n/a through 1.23.11.6.
• CVE-2023-41730 — CVSS 4.3 (medium): Cross-Site Request Forgery (CSRF) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions.