SendPress — Vulnerabilities & Security Advisories 4

SendPress is a WordPress plugin for email newsletter management and campaign distribution. Historically, it has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, as evidenced by its four recorded CVEs. The plugin's security posture has been compromised through insufficient input validation and improper access controls, allowing attackers to execute unauthorized commands, inject malicious scripts, or gain elevated administrative privileges. While no major public incidents have been widely documented, the consistent pattern of vulnerabilities across different versions highlights ongoing security challenges that require immediate patching and careful implementation by users.