Vendor CVEs

Tribulant

All CVEs

34 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2018-20987	Tribulant Newsletters	Cri	0.64	9.8	0.02	Aug 22, 2019	The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.
CVE-2018-18018	Tribulant Slideshow Gallery	Cri	0.64	9.8	0.02	Apr 15, 2019	SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
CVE-2024-32954	Tribulant Newsletters	Cri	0.59	9.1	0.01	Apr 24, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.5.
CVE-2024-8247	WordPress Newsletter	Hig	0.57	8.8	0.00	Sep 6, 2024	The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the plugin not restricting what user meta can be updated as screen options. This makes it possible for authenticated attackers, with…
CVE-2019-15828	WordPress one-click-ssl	Hig	0.57	8.8	0.01	Aug 30, 2019	The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.
CVE-2019-14788	Tribulant Newsletters	Hig	0.57	8.8	0.04	Aug 15, 2019	wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
CVE-2024-31355	Tribulant Slideshow Gallery	Hig	0.55	8.5	0.01	Apr 10, 2024	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
CVE-2025-54034	Tribulant Newsletters	Hig	0.49	7.5	0.00	Aug 20, 2025	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Tribulant Software Newsletters newsletters-lite allows PHP Local File Inclusion.This issue affects Newsletters: from n/a through <= 4.10.
CVE-2025-30921	Tribulant Newsletters	Hig	0.49	7.6	0.00	Mar 27, 2025	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through <= 4.9.9.7.
CVE-2020-35932	WordPress Newsletter	Hig	0.49	7.5	0.02	Jan 1, 2021	Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE:…
CVE-2025-4857	Tribulant Newsletters	Hig	0.47	7.2	0.01	May 31, 2025	The Newsletters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.9.9 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary…
CVE-2023-4797	WordPress Newsletter	Hig	0.47	7.2	0.01	Jan 16, 2024	The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.
CVE-2025-30858	Tribulant Snow Storm	Hig	0.46	7.1	0.00	Apr 3, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected XSS.This issue affects Snow Storm: from n/a through <= 1.4.6.
CVE-2025-26931	Tribulant Tribulant Gallery Voting	Hig	0.46	7.1	0.00	Feb 25, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Tribulant Gallery Voting gallery-voting allows Stored XSS.This issue affects Tribulant Gallery Voting: from n/a through <= 1.2.1.
CVE-2025-24599	Tribulant Newsletters	Hig	0.46	7.1	0.00	Feb 4, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.6.
CVE-2024-47346	Tribulant Newsletters	Hig	0.46	7.1	0.00	Oct 6, 2024	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.1.
CVE-2024-43279	Tribulant Newsletters	Hig	0.46	7.1	0.00	Aug 18, 2024	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS.This issue affects Newsletters: from n/a through 4.9.8.
CVE-2024-35718	Tribulant Newsletters	Hig	0.46	7.1	0.00	Jun 8, 2024	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS.This issue affects Newsletters: from n/a through 4.9.5.
CVE-2023-28491	Tribulant Slideshow Gallery	Med	0.44	6.7	0.01	Dec 20, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6.
CVE-2025-69020	Tribulant Newsletters	Med	0.42	6.5	0.00	Dec 30, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <= 4.12.
CVE-2024-13739	WordPress Newsletter	Med	0.40	6.1	0.00	Mar 22, 2025	The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
CVE-2018-18019	Tribulant Slideshow Gallery	Med	0.40	6.1	0.01	Apr 15, 2019	XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter.
CVE-2018-18017	Tribulant Slideshow Gallery	Med	0.40	6.1	0.01	Apr 15, 2019	XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
CVE-2018-17946	Tribulant Slideshow Gallery	Med	0.40	6.1	0.01	Oct 3, 2018	The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.
CVE-2024-47376	Tribulant Slideshow Gallery	Med	0.38	5.9	0.00	Oct 5, 2024	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Slideshow Gallery slideshow-gallery allows Cross-Site Scripting (XSS).This issue affects Slideshow Gallery: from n/a through <= 1.8.3.
CVE-2024-10181	WordPress Newsletter	Med	0.35	6.4	0.00	Oct 29, 2024	The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video shortcode in all versions up to, and including, 4.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…
CVE-2023-28497	Tribulant Slideshow Gallery	Med	0.35	5.4	0.00	Nov 12, 2023	Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery LITE plugin <= 1.7.6 versions.
CVE-2023-30478	Tribulant Newsletters	Med	0.35	5.4	0.00	Nov 10, 2023	Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin <= 4.8.8 versions.
CVE-2019-14787	Tribulant Newsletters	Med	0.35	5.4	0.01	Aug 9, 2019	The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
CVE-2024-31353	Tribulant Slideshow Gallery	Med	0.34	5.3	0.00	Apr 10, 2024	Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
CVE-2021-24882	WordPress Slideshow Gallery	Med	0.31	4.8	0.01	Nov 23, 2021	The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
CVE-2024-37227	Tribulant Newsletters	Med	0.28	4.3	0.00	Jun 21, 2024	Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.7.
CVE-2014-5460	Tribulant Slideshow Gallery		0.09	—	0.71	Sep 11, 2014	Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in…
CVE-2026-57394	Tribulant Newsletters	Hig	0.00	7.1	0.00	Jul 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.14.

CVE-2018-20987CriAug 22, 2019
Tribulant
Newsletters
risk 0.64cvss 9.8epss 0.02
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.
CVE-2018-18018CriApr 15, 2019
Tribulant
Slideshow Gallery
risk 0.64cvss 9.8epss 0.02
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
CVE-2024-32954CriApr 24, 2024
Tribulant
Newsletters
risk 0.59cvss 9.1epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.5.
CVE-2024-8247HigSep 6, 2024
WordPress
Newsletter
risk 0.57cvss 8.8epss 0.00
The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the plugin not restricting what user meta can be updated as screen options. This makes it possible for authenticated attackers, with…
CVE-2019-15828HigAug 30, 2019
WordPress
one-click-ssl
risk 0.57cvss 8.8epss 0.01
The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.
CVE-2019-14788HigAug 15, 2019
Tribulant
Newsletters
risk 0.57cvss 8.8epss 0.04
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
CVE-2024-31355HigApr 10, 2024
Tribulant
Slideshow Gallery
risk 0.55cvss 8.5epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
CVE-2025-54034HigAug 20, 2025
Tribulant
Newsletters
risk 0.49cvss 7.5epss 0.00
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Tribulant Software Newsletters newsletters-lite allows PHP Local File Inclusion.This issue affects Newsletters: from n/a through <= 4.10.
CVE-2025-30921HigMar 27, 2025
Tribulant
Newsletters
risk 0.49cvss 7.6epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through <= 4.9.9.7.
CVE-2020-35932HigJan 1, 2021
WordPress
Newsletter
risk 0.49cvss 7.5epss 0.02
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE:…
CVE-2025-4857HigMay 31, 2025
Tribulant
Newsletters
risk 0.47cvss 7.2epss 0.01
The Newsletters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.9.9 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary…
CVE-2023-4797HigJan 16, 2024
WordPress
Newsletter
risk 0.47cvss 7.2epss 0.01
The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.
CVE-2025-30858HigApr 3, 2025
Tribulant
Snow Storm
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected XSS.This issue affects Snow Storm: from n/a through <= 1.4.6.
CVE-2025-26931HigFeb 25, 2025
Tribulant
Tribulant Gallery Voting
risk 0.46cvss 7.1epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Tribulant Gallery Voting gallery-voting allows Stored XSS.This issue affects Tribulant Gallery Voting: from n/a through <= 1.2.1.
CVE-2025-24599HigFeb 4, 2025
Tribulant
Newsletters
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.6.
CVE-2024-47346HigOct 6, 2024
Tribulant
Newsletters
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.1.
CVE-2024-43279HigAug 18, 2024
Tribulant
Newsletters
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS.This issue affects Newsletters: from n/a through 4.9.8.
CVE-2024-35718HigJun 8, 2024
Tribulant
Newsletters
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS.This issue affects Newsletters: from n/a through 4.9.5.
CVE-2023-28491MedDec 20, 2023
Tribulant
Slideshow Gallery
risk 0.44cvss 6.7epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6.
CVE-2025-69020MedDec 30, 2025
Tribulant
Newsletters
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <= 4.12.
CVE-2024-13739MedMar 22, 2025
WordPress
Newsletter
risk 0.40cvss 6.1epss 0.00
The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
CVE-2018-18019MedApr 15, 2019
Tribulant
Slideshow Gallery
risk 0.40cvss 6.1epss 0.01
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter.
CVE-2018-18017MedApr 15, 2019
Tribulant
Slideshow Gallery
risk 0.40cvss 6.1epss 0.01
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
CVE-2018-17946MedOct 3, 2018
Tribulant
Slideshow Gallery
risk 0.40cvss 6.1epss 0.01
The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.
CVE-2024-47376MedOct 5, 2024
Tribulant
Slideshow Gallery
risk 0.38cvss 5.9epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Slideshow Gallery slideshow-gallery allows Cross-Site Scripting (XSS).This issue affects Slideshow Gallery: from n/a through <= 1.8.3.
CVE-2024-10181MedOct 29, 2024
WordPress
Newsletter
risk 0.35cvss 6.4epss 0.00
The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video shortcode in all versions up to, and including, 4.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…
CVE-2023-28497MedNov 12, 2023
Tribulant
Slideshow Gallery
risk 0.35cvss 5.4epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery LITE plugin <= 1.7.6 versions.
CVE-2023-30478MedNov 10, 2023
Tribulant
Newsletters
risk 0.35cvss 5.4epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin <= 4.8.8 versions.
CVE-2019-14787MedAug 9, 2019
Tribulant
Newsletters
risk 0.35cvss 5.4epss 0.01
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
CVE-2024-31353MedApr 10, 2024
Tribulant
Slideshow Gallery
risk 0.34cvss 5.3epss 0.00
Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
CVE-2021-24882MedNov 23, 2021
WordPress
Slideshow Gallery
risk 0.31cvss 4.8epss 0.01
The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
CVE-2024-37227MedJun 21, 2024
Tribulant
Newsletters
risk 0.28cvss 4.3epss 0.00
Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.7.
CVE-2014-5460Sep 11, 2014
Tribulant
Slideshow Gallery
risk 0.09cvss —epss 0.71
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in…
CVE-2026-57394HigJul 13, 2026
Tribulant
Newsletters
risk 0.00cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.14.