mailerlite vulnerabilities

Products

• MailerLite – Signup forms (official) 4
• MailerLite – WooCommerce integration 4
• MailerLite 2
• mailerlite signup forms 2
• MailerLite (WordPress plugin) 1

Latest mailerlite CVEs

Newest publication first

1. CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

   Published 2026-09-24

   Medium·CVSS 4.3 EPSS 0.19%

   The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authentic...

2. CVE-2026-25420 WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability

   Published 2026-02-19

   Medium·CVSS 4.3 EPSS 0.28%

   Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.

3. CVE-2025-67945 WordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability

   Published 2026-01-22

   Critical·CVSS 9.3 EPSS 0.44%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite – WooCommerce integration: from n/a through <= 3.1.2.

4. CVE-2026-1000 MailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data Deletion

   Published 2026-01-16

   Medium·CVSS 6.5 EPSS 0.33%

   The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to missing capability checks on the resetIntegration() function. This makes it possible for authenti...

5. CVE-2025-13993 MailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting

   Published 2025-12-12

   Medium·CVSS 5.5 EPSS 0.37%

   The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_description' and 'success_message' parameters in versions up to, and including, 1.7.16 due to insufficient input sanitization and output escaping. This makes i...

6. CVE-2023-52227 WordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerability

   Published 2024-06-11

   Medium·CVSS 4.3 EPSS 0.41%

   Missing Authorization vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.

7. CVE-2024-2797 MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization

   Published 2024-05-02

   Medium·CVSS 5.3 EPSS 0.50%

   The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized plugin setting changes due to a missing capability check on the toggleRolesAndPermissions and editAllowedRolesAndPermissions functions in all versions up to, and including, 1.7.6. This mak...

8. CVE-2024-1386 MailerLite – Signup forms (official) 1.5.0 - 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

   Published 2024-05-02

   Medium·CVSS 6.4 EPSS 0.42%

   The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions 1.5.0 to 1.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for a...

9. CVE-2023-52223 WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2024-02-28

   High·CVSS 8.8 EPSS 0.21%

   Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.

10. CVE-2022-33201 WordPress MailerLite – Signup forms (official) plugin <= 1.5.7 - Cross-Site Request Forgery (CSRF) vulnerability

    Published 2022-08-05

    High·CVSS 8.8 EPSS 0.38%

    Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.

11. CVE-2022-1604 MailerLite < 1.5.4 - Reflected Cross-Site Scripting

    Published 2022-06-13

    Medium·CVSS 6.1 EPSS 0.86%

    The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.