Live › vulnerability › CVE-2026-116863
Go to dashboardThe Newsletters Lite WordPress plugin from Tribulant Software has a cross-site request forgery flaw in versions through 4.18.2. A logged-in administrator who visits a malicious page could be tricked into making changes to the plugin's settings or data without knowing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
WordPress sites running the Newsletters Lite plugin at version 4.18.2 or earlier are exposed. Risk is highest where administrators stay logged in while browsing other sites. Sites without the plugin installed can skip it.
No product ranges from the sources yet.
wp plugin get newsletters-lite --field=version4.18.2, as published by the vendor (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-116863")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.