Skip to content
PluginCanary

Newsletter

Newsletter - Send awesome emails from WordPress
by Stefano Lissa · 200,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 2 Nov 2026, 94 releases in 24 months, no unpatched vulnerabilities.

80/ 100 Canary Score
Sub-scores for Newsletter
Ownership100
Maintenance100
Security60
Support65
Reputation70

How the score works

Quick answers

Is Newsletter still maintained?
Yes. Last release 2 Nov 2026, 94 releases in the last 24 months. 2 Nov 2026 · wordpress.org
Who owns Newsletter, and has it changed hands?
No change recorded. Main committer satollo since May 2009. 4 Nov 2026 · SVN log
Was Newsletter removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Newsletter safe?
24 known vulnerabilities, all fixed (latest in 9.4.1). Not on the exploited list. 1 Oct 2026 · Wordfence Intelligence
Is the latest Newsletter update safe to install?
No ownership change before 9.5.4. No one-star spike after it. 2 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
satollo23 May 2009 to 2 Nov 2026, 912 commits
webagile22 Dec 2014 to 23 Oct 2023, 93 commits

2 committers recorded. No ownership change since 2009.

Maintenance

Last release
2 days ago
Releases, 24 months
94
Tested up to
7.1 current
Requires PHP
7.0 supported 8.2+
Releases per quarter
Releases per quarter for Newsletter
Q1 202419
Q2 202417
Q3 202410
Q4 202412
Q1 202512
Q2 202515
Q3 20256
Q4 202513
Q1 202611
Q2 20268
Q3 202616
Q4 20269

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 3.0 (2 reviews). Lifetime: 4.6.

Average rating per quarter for Newsletter
Q1 20254.0
Q2 20254.4
Q3 20254.3
Q4 20253.7
Q1 20265.0
Q2 20263.5
Q3 20263.0
Q4 20265.0

Average rating rose from 4.0 to 5.0 between Q1 2025 and Q4 2026.

Rating distribution
5 star976
4 star107
3 star35
2 star22
1 star65
Latest low reviews

Security record

10 vulnerabilities in 24 months (24 on record), all patched (latest fixed in 9.4.1).

Show 24 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
1 Oct 2026Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter7.2<= 9.4.09.4.1Patched before disclosure
30 Sep 2026Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)5.3<= 9.3.99.4.0Patched before disclosure
17 Sep 2026Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter6.1<= 9.3.89.3.9Patched before disclosure
19 Aug 2026Newsletter - Send awesome emails from WordPress <= 9.3.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 9.3.39.3.4Patched before disclosure
19 Jan 2026Newsletter - Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription4.3<= 9.1.09.1.1Patched before disclosure
15 Dec 2025Newsletter <= 9.0.9 - Authenticated (Administrator+) SQL Injection4.9<= 9.0.99.1.0Patched before disclosure
19 May 2025Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5<= 8.8.48.8.5Patched before disclosure
19 May 2025Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 8.8.48.8.5Patched before disclosure
13 May 2025Newsletter <= 8.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 8.8.18.8.2Patched before disclosure
14 Apr 2025Newsletter <= 8.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 8.7.08.7.1Patched before disclosure
4 Jun 2024Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np16.4<= 8.3.48.3.5Patched before disclosure
10 Apr 2024Newsletter <= 8.0.6 - Cross-Site Request Forgery4.3<= 8.0.68.0.7Patched before disclosure
28 Mar 2024Newsletter <= 8.2.0 - IP Spoofing5.3<= 8.2.08.2.1Patched before disclosure
10 Jan 2024Newsletter <= 8.0.6 - Cross-Site Request Forgery4.7<= 8.0.68.0.7Patched before disclosure
17 Aug 2023Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 7.8.97.9.01
27 Mar 2023Newsletter <= 7.6.8 - Reflected Cross-Site Scripting4.7<= 7.6.87.6.9Patched before disclosure
30 May 2022Newsletter <= 7.4.5 - Authenticated (Admin+) Stored Cross-Site Scripting5.5< 7.4.67.4.6Patched before disclosure
23 May 2022Newsletter - Send awesome emails from WordPress <= 7.4.4 - Reflected Cross-Site Scripting6.1<= 7.4.47.4.5Patched before disclosure
3 Aug 2020Newsletter <= 6.8.1 - Reflected Cross-Site Scripting6.5< 6.8.26.8.2Patched before disclosure
2 Aug 2020Newsletter <= 6.8.1 - Authenticated PHP Object Injection7.5< 6.8.26.8.2Patched before disclosure
12 Jul 2020Newsletter <= 6.7.6 - Stored Cross-Site Scripting8.3<= 6.7.66.7.7Patched before disclosure
16 Mar 2020Newsletter <= 6.5.3 - CSV Injection5.5<= 6.5.36.5.4Patched before disclosure
30 Mar 2015Newsletter <= 3.8.2 - Open Redirect4.3<= 3.8.23.8.3n/a
14 May 2013Newsletter <= 3.2.6 - Reflected Cross-Site Scripting6.1<= 3.2.63.2.72215

Changelog mentions of security fixes: 9.3.4 (vulnerability, XSS); 9.3.8 (security); 9.3.9 (vulnerability); 9.4.0 (vulnerability); 9.5.2 (SQL injection).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

65% of 17 support threads resolved in the last 2 months.

Momentum

200,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Newsletter
4 May 20265,058
11 May 202613,644
18 May 202624,286
25 May 2026101,775
1 Jun 2026100,373
8 Jun 202618,829
15 Jun 202696,441
22 Jun 2026101,574
29 Jun 202616,049
6 Jul 2026108,699
13 Jul 2026112,578
20 Jul 202617,987
27 Jul 202695,711
3 Aug 2026116,000
10 Aug 202616,925
17 Aug 2026194,629
24 Aug 202619,989
31 Aug 202614,776
7 Sep 2026169,319
14 Sep 2026163,820
21 Sep 2026233,695
28 Sep 2026243,602
5 Oct 2026114,608
12 Oct 202616,560
19 Oct 2026187,934
26 Oct 2026273,588
2 Nov 20265,158

Weekly downloads over the last 4 weeks are 26% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

KlaviyoScore 100 · 100,000+Mailjet Email MarketingScore 98 · 10,000+SureContactScore 97 · 10,000+Mailchimp List Subscribe FormScore 95 · 60,000+Kit (formerly ConvertKit)Score 95 · 40,000+

Facts

Version9.5.4
AuthorStefano Lissa
Added23 May 2009
Last updated2 Nov 2026
Active installs200,000+
Requires WordPress6.1
Tested up to7.1.4
Requires PHP7.0
CategoryMarketing & Advertising > Email Marketing & Campaigns
Tagsnewsletter, signup forms, subscription, welcome email, Email Marketing

Other plugins by this author: Head, Footer and Post Injections, Hyper Cache, Include Me, Comment Image, Thumbnails and Featured Images, Comment Notifier, Popup Maker Addon for Newsletter, Lite Cache, RSS Block for Newsletter, BuddyPress Addon for Newsletter, Ads for bbPress, Other Posts

Questions

Is Newsletter still maintained?

Yes. Last release 2 Nov 2026, 94 releases in the last 24 months.

Who owns Newsletter, and has it changed hands?

No change recorded. Main committer satollo since May 2009.

Was Newsletter removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Newsletter safe?

24 known vulnerabilities, all fixed (latest in 9.4.1). Not on the exploited list.

Is the latest Newsletter update safe to install?

No ownership change before 9.5.4. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue