Known vulnerabilities in SendPress Newsletters

A Newsletter Plugin for WordPress to create, send, manage and track your Newsletters in one place.

10Reported vulnerabilities

8.8Highest CVSS score

1.26.1.20Latest version

1,000+Active installs

What to do now

Update SendPress Newsletters to 1.23.11.6 or later. 5 of these have a fixed version available. Updating resolves them.

Plugin last updated: February 7, 2026 / Tested up to WordPress: 6.7.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2015-9448	High 8.8	1.9%	Before 1.2	`1.2`	September 26, 2019
CVE-2024-1588	Medium 6.8	0.7%	1.23.11.6 and earlier	—	April 8, 2024
CVE-2024-1589	Medium 6.1	0.4%	1.23.11.6 and earlier	—	April 8, 2024
CVE-2023-5660	Medium 5.4	0.7%	Before 1.23.11.6	`1.23.11.6`	November 7, 2023
WF-e8d042be-e272-4e2d-93ec-83a0a42ecd51	Medium 6.4	—	Before 1.20.7.13	`1.20.7.13`	July 13, 2020
CVE-2023-47517	Medium 6.1	0.4%	1.23.11.6 and earlier	`1.24.8.19`	November 7, 2023
WF-5570b8ef-6fb9-4f9e-be39-d8c615d1abab	Medium 6.1	—	1.1.7.21 and earlier	`1.2`	July 23, 2015
CVE-2023-35040	Medium 5.3	0.4%	1.23.11.6 and earlier	—	August 11, 2023
CVE-2023-41729	Medium 4.4	0.3%	1.23.11.6 and earlier	—	September 5, 2023
CVE-2023-41730	Medium 4.3	0.2%	1.23.11.6 and earlier	—	September 5, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.