Skip to content
PluginCanary

Newsletters

by Tribulant Software · 2,000+ active installs · Checked 3 Nov 2026
Avoid1 Critical8 Warnings

Avoid: vulnerability published 27 Oct 2026 with no patched version yet.

39/ 100 Canary Score

Capped at 39 while a vulnerability has no patch.

Sub-scores for Newsletters
Ownership100
Maintenance100
Security0
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • CriticalSEC-1Vulnerability published 27 Oct 2026 with no patched version yet. Disable or replace the plugin until a fix is released.27 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 4.18.2. Update to version 4.18.2 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Oct 2026, fixed in 4.18.2. Update to version 4.18.2 or later.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Oct 2026, fixed in 4.18.2. Update to version 4.18.2 or later.22 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 21 Sep 2026, fixed in 4.18.1. Update to version 4.18.1 or later.21 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 17 Sep 2026, fixed in 4.18.1. Update to version 4.18.1 or later.17 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 29 Aug 2026, fixed in 4.17. Update to version 4.17 or later.29 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 27 Aug 2026, fixed in 4.17. Update to version 4.17 or later.27 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 24 Aug 2026, fixed in 4.18. Update to version 4.18 or later.24 Aug 2026Evidence
  • InfoSEC-329 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
contrid26 Aug 2014 to 24 Jul 2021, 486 commits
airnayden28 Jul 2021 to 13 Aug 2021, 8 commits
adamluzsi22 Oct 2021 to 23 Dec 2021, 5 commits
mohsenr121 Aug 2022 to 20 Oct 2026, 86 commits

4 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
15 days ago
Releases, 24 months
14
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter for Newsletters
Q1 20241
Q2 20243
Q3 20244
Q4 20244
Q1 20251
Q2 20252
Q3 20251
Q4 20250
Q1 20260
Q2 20263
Q3 20264
Q4 20261

Last release 20 Oct 2026. Tested with WordPress 7.1 (current).

Support

Support history appears after our first snapshots of the forum counts.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter5.3<= 4.18.14.18.20
27 Oct 2026Newsletters <= 4.18.2 - Cross-Site Request Forgery4.3<= 4.18.2No fixn/a
22 Oct 2026Newsletters <= 4.18.1 - Unauthenticated PHP Object Injection8.1<= 4.18.14.18.20
22 Oct 2026Newsletters <= 4.18.1 - Unauthenticated SQL Injection7.5<= 4.18.14.18.20
21 Sep 2026Newsletters <= 4.18.0 - Unauthenticated Insecure Direct Object Reference5.3<= 4.18.04.18.10
17 Sep 2026Newsletters <= 4.18 - Authenticated (Administrator+) SQL Injection4.9<= 4.184.18.10
29 Aug 2026Newsletters < 4.17 - Cross-Site Request Forgery4.3< 4.174.170
27 Aug 2026Newsletters < 4.17 - Insufficient Authorization5.3< 4.174.170
24 Aug 2026Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter4.3<= 4.174.180
3 Aug 2026Newsletters <= 4.15 - Unauthenticated PHP Object Injection8.1<= 4.154.160
3 Aug 2026Newsletters <= 4.15 - Unauthenticated API Authorization Bypass via Type Juggling7.3<= 4.154.160
30 Jul 2026Newsletters <= 4.15 - Unauthenticated Server-Side Request Forgery7.2<= 4.154.160
28 Jul 2026Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute6.4<= 4.154.160
28 Jul 2026Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute6.4<= 4.154.160
8 Jul 2026Newsletters <= 4.14 - Unauthenticated Stored Cross-Site Scripting7.2<= 4.144.150
26 Jun 2026Newsletters <= 4.13 - Missing Authorization4.3<= 4.134.140
23 Jun 2026Newsletters <= 4.14 - Unauthenticated PHP Object Injection8.1<= 4.144.150
18 Jun 2026Newsletters <= 4.13 - Missing Authorization5.3<= 4.134.140
9 Jun 2026Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter7.5<= 4.134.141
31 Dec 2025Newsletters <= 4.11 - Unauthenticated PHP Object Injection8.1<= 4.114.12n/a
28 Dec 2025Newsletters <= 4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.124.13164
29 Jul 2025Newsletters <= 4.10 - Unauthenticated Local File Inclusion8.1<= 4.104.110
16 Jul 2025Newsletters <= 4.10 - Cross-Site Request Forgery4.3<= 4.104.110
30 May 2025Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion7.2<= 4.9.9.94.101
12 May 2025Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter6.5<= 4.9.9.84.9.9.90

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.7 from 246 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star200
4 star25
3 star9
2 star5
1 star7

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Newsletters
4 May 202677
11 May 2026178
18 May 2026163
25 May 2026178
1 Jun 2026133
8 Jun 20261,477
15 Jun 20261,357
22 Jun 2026370
29 Jun 2026496
6 Jul 2026370
13 Jul 2026233
20 Jul 20261,247
27 Jul 2026783
3 Aug 20261,491
10 Aug 2026595
17 Aug 2026313
24 Aug 20261,576
31 Aug 2026409
7 Sep 2026324
14 Sep 20261,603
21 Sep 2026503
28 Sep 2026617
5 Oct 2026600
12 Oct 2026474
19 Oct 20262,199
26 Oct 2026775
2 Nov 202674

Weekly downloads over the last 4 weeks are 28% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

SureContact - Newsletters, Email Marketing, Automation, Revenue Tracking & CRMScore 93 · 10,000+Hostinger Reach - AI-Powered Email Marketing for WordPressScore 91 · 1,000,000+MailPoet - Newsletters, Email Marketing, and AutomationScore 91 · 500,000+KlaviyoScore 91 · 100,000+Newsletters, Email Marketing, SMS and Popups by OmnisendScore 91 · 100,000+

Facts

Version4.18.2
AuthorTribulant Software
Added26 Aug 2014
Last updated20 Oct 2026
Active installs2,000+
Requires WordPress3.8
Tested up to7.1.4
Requires PHPnot stated
CategoryMarketing & Advertising > Email Marketing & Campaigns
Tagsemail, bulk email, newsletters, subscribers, mailing list

Other plugins by this author: One Click SSL, Slideshow Gallery LITE, Tribulant Gallery Voting, Snow Storm, MooTools, Tribulant Thumbshots

Questions

Is Newsletters still maintained?

Newsletters was last updated on 20 Oct 2026. Its Canary status is Avoid.

Is Newsletters safe?

Newsletters has 1 published vulnerability with no patched version. Its Canary status is Avoid.

Who owns Newsletters?

The wordpress.org author is Tribulant Software. Recent committers: mohsenr1, adamluzsi, airnayden, contrid, plugin-master. We have recorded no ownership change.

What can I use instead of Newsletters?

Plugins in the same category with a higher Canary Score: SureContact - Newsletters, Email Marketing, Automation, Revenue Tracking & CRM, Hostinger Reach - AI-Powered Email Marketing for WordPress, MailPoet - Newsletters, Email Marketing, and Automation, Klaviyo, Newsletters, Email Marketing, SMS and Popups by Omnisend.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue