Newsletters

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

A small install base leaves thin data to model from. The range spans more than 10x because wp.org publishes install counts as broad bands, and conversion and price compound on top. Read the midpoint as an order of magnitude, not a valuation.

1. ★★★★★ Justin

   3mo ago

   Nowhere did I see the 500 subscriber limit, not until I investigated the logs when I wondered why it wasn’t sending. Uninstalling.

   Read on wp.org ↗
2. ★★★★★ wpvolker1

   7mo ago

   can recommend.

   Read on wp.org ↗
3. ★★★★★ imijam

   1.0y ago

   Great plugin with excellent support! This is one of the few newsletter plugins that works well and allows you to send PDF attachments with your message. Recently, we encountered a problem sending newsletters. We couldn’t figure it out and contacted Tribulant for advice. The support team was very friendly and quickly resolved the issue.

   Read on wp.org ↗
4. ★★★★★ gutte

   1.3y ago

   I have used this plugin for quite some time. But it was tiresome to set up and to customize. And I newer really was sure how the newsletters would show up when received by customers. I tested it, but sometimes the header would not show up.I finally left it and opted by a online newsletter/email system, that is sooo much easier to handle. This topic was modified 1 year, 2 months ago by gutte. This topic was modified 1 year, 2 months ago by gutte.

   Read on wp.org ↗
5. ★★★★★ gattodigital

   3.0y ago

   Not happy with the harrassing notice every time I log in to WordPress to leave a review. Also, the output HTML is extremely junky. Other than that, the free version more or less meets functionality.

   Read on wp.org ↗
6. ★★★★★ herbert

   3.1y ago

   Had a problem with the plugin, got some strange errors on cloning newsletters with content areas and also on sending through Mailgun api. Opened ticket in Tribulant support and after a good week they had it fixed. Great service.

   Read on wp.org ↗
7. ★★★★★ dave10001

   3.3y ago

   I’m rooting for this one to get better. When functional, it can be good. That said, its functionality has proved to be rather volatile at times. Regarding customer service, there’s room for improvement. I have received some help from them and it’s been appreciated when it came through. That said, the predictability of timely responses isn’t there. That can be frustrating when issues arise (and they often do). This topic was modified 3 years, 2 months ago by dave10001. This topic was modified 3 years, 2 months ago by dave10001. This topic was modified 3 years, 1 month ago by dave10001. This topic was modified 3 years, 1 month ago by dave10001. This topic was modified 3 years, 1 month ago by dave10001. This topic was modified 3 years ago by dave10001. This topic was modified 3 years ago by dave10001. This topic was modified 3 years ago by dave10001.

   Read on wp.org ↗
8. ★★★★★ vagtech

   3.4y ago

   Our email system has been through many different companies trying to get out of spam folders and into the inbox. all of them said they guaranteed results. but the only results were to be listed on spam lists because of shared IP address or entire IP blocks being listed and we just happen to be in a bad IP network. once we started using Tribulant our numbers to the inbox almost quadrupled because we were using our own server and not a service. And after their support team showed us how our site was slow and how to fix it, along with the updates they have helped us with regarding our send rate issues, i couldn’t be happier with the software or their service. we have even transferred from our old hosting service to tribulants hosting for a much faster and flexible system then our old expensive “daddy”. as to the software itself… its very flexible and has many features that more expensive services do not have. the ability to use your hosting server or an external smtp server for sending makes it useable if you already have a SMTP service you send through. the bounce and unsubscribe features are automatic when setup correctly and make you fully compliant with the BIG 4 mail services (gmail, aol, hotmail, and yahoo) along with all the rest as far as removal of unhappy recipients. The Newsletter Creator is simple to learn and use as well as fully customizable to make it look and feel like a part of your website…or be something completely new each mail you send. the mailing lists being a separate list than the website user list was a major factor for us but its ability to link to a site user would be very useful in others cases. stuff i haven’t even got to tinker with yet are the ability to customize the sign up and list management pages for the subscribers. or the subscription to multiple lists for different send rates (day/week/month) or products or whatever… and the cost makes it a tool that can grow as you do and not kill your bank account just to try. and the MANY more features i haven’t list here, are the reason im leaving this long review. I hope this helps someone make a decision… because Tribulant helped us, Im sure they could help you.

   Read on wp.org ↗

36 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.3 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter ↗
   2026-08-24 CVE-2026-75908 Missing Authorization Affects <= 4.17 Patched in 4.18
2. High · 8.1 Newsletters <= 4.15 - Unauthenticated PHP Object Injection ↗
   2026-08-03 CVE-2026-16267 Deserialization of Untrusted Data Affects <= 4.15 Patched in 4.16
3. High · 7.2 Newsletters <= 4.15 - Unauthenticated Server-Side Request Forgery ↗
   2026-07-30 CVE-2026-16268 Server-Side Request Forgery (SSRF) Affects <= 4.15 Patched in 4.16
4. Medium · 6.4 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute ↗
   2026-07-28 CVE-2026-12939 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15 Patched in 4.16
5. Medium · 6.4 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute ↗
   2026-07-28 CVE-2026-12938 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.15 Patched in 4.16
6. High · 7.2 Newsletters <= 4.14 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-08 CVE-2026-57394 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.14 Patched in 4.15
7. Medium · 4.3 Newsletters <= 4.13 - Missing Authorization ↗
   2026-06-26 CVE-2026-57645 Missing Authorization Affects <= 4.13 Patched in 4.14
8. High · 8.1 Newsletters <= 4.14 - Unauthenticated PHP Object Injection ↗
   2026-06-23 CVE-2026-12583 Deserialization of Untrusted Data Affects <= 4.14 Patched in 4.15
9. Medium · 5.3 Newsletters <= 4.13 - Missing Authorization ↗
   2026-06-18 CVE-2026-54840 Missing Authorization Affects <= 4.13 Patched in 4.14
10. High · 7.5 Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter ↗
    2026-06-09 CVE-2026-3018 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 4.13 Patched in 4.14
11. High · 8.1 Newsletters <= 4.11 - Unauthenticated PHP Object Injection ↗
    2025-12-31 CVE-2025-67911 Deserialization of Untrusted Data Affects <= 4.11 Patched in 4.12
12. Medium · 6.4 Newsletters <= 4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-12-28 CVE-2025-69020 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.12 Patched in 4.13
13. High · 8.1 Newsletters <= 4.10 - Unauthenticated Local File Inclusion ↗
    2025-07-29 CVE-2025-54034 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 4.10 Patched in 4.11
14. Medium · 4.3 Newsletters <= 4.10 - Cross-Site Request Forgery ↗
    2025-07-16 CVE-2025-54035 Cross-Site Request Forgery (CSRF) Affects <= 4.10 Patched in 4.11
15. High · 7.2 Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion ↗
    2025-05-30 CVE-2025-4857 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 4.9.9.9 Patched in 4.10
16. Medium · 6.5 Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter ↗
    2025-05-12 CVE-2025-3107 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 4.9.9.8 Patched in 4.9.9.9
17. Medium · 4.9 Newsletters <= 4.9.9.7 - Authenticated (Administrator+) SQL Injection ↗
    2025-03-27 CVE-2025-30921 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 4.9.9.7 Patched in 4.9.9.8
18. High · 7.2 Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting ↗
    2025-03-25 CVE-2025-2009 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.9.9.7 Patched in 4.9.9.8
19. Medium · 6.1 Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter ↗
    2025-03-21 CVE-2024-13739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.9.9.7 Patched in 4.9.9.8
20. Medium · 6.1 Newsletters <= 4.9.9.6 - Reflected Cross-Site Scripting ↗
    2024-12-26 CVE-2025-24599 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.9.9.6 Patched in 4.9.9.7
21. Medium · 6.4 Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode ↗
    2024-10-28 CVE-2024-10181 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.9.9.4 Patched in 4.9.9.5
22. Medium · 6.1 Newsletters <= 4.9.9.1 - Reflected Cross-Site Scripting ↗
    2024-09-27 CVE-2024-47346 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.9.9.1 Patched in 4.9.9.2
23. High · 8.8 Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation ↗
    2024-09-05 CVE-2024-8247 Improper Privilege Management Affects <= 4.9.9.2 Patched in 4.9.9.3
24. Medium · 6.1 Newsletters <= 4.9.8 - Reflected Cross-Site Scripting ↗
    2024-08-16 CVE-2024-43279 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.9.8 Patched in 4.9.9
25. Medium · 5.3 Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure ↗
    2024-08-14 CVE-2024-7411 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.9.9 Patched in 4.9.9.1
26. Medium · 4.3 Newsletters <= 4.9.7 - Cross-Site Request Forgery ↗
    2024-06-21 CVE-2024-37227 Cross-Site Request Forgery (CSRF) Affects <= 4.9.7 Patched in 4.9.8
27. Medium · 6.1 Newsletters <= 4.9.5 - Reflected Cross-Site Scripting ↗
    2024-06-06 CVE-2024-35718 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.9.5 Patched in 4.9.6
28. Medium · 5.3 Newsletters <= 4.9.5 - Information Exposure via Log files ↗
    2024-04-22 CVE-2024-32953 Insertion of Sensitive Information into Log File Affects <= 4.9.5 Patched in 4.9.6
29. Critical · 9.1 Newsletters <= 4.9.5 - Authenticated (Admin+) Arbitrary File Upload ↗
    2024-04-22 CVE-2024-32954 Unrestricted Upload of File with Dangerous Type Affects <= 4.9.5 Patched in 4.9.6
30. Medium · 6.6 Newsletter Lite <= 4.9.2 - Authenticated (Admin+) Command Injection ↗
    2023-10-05 CVE-2023-4797 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Affects <= 4.9.2 Patched in 4.9.3
31. Medium · 5.4 Newsletters <= 4.8.8 - Cross-Site Request Forgery ↗
    2023-04-13 CVE-2023-30478 Cross-Site Request Forgery (CSRF) Affects <= 4.8.8 Patched in 4.8.9
32. High · 8.8 Newsletters <= 4.6.18 - Directory Traversal ↗
    2019-07-01 CVE-2019-14788 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects < 4.6.19 Patched in 4.6.19
33. Medium · 5.4 Newsletters <= 4.6.18 - Cross-Site Scripting via contentarea Parameter ↗
    2019-07-01 CVE-2019-14787 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.6.19 Patched in 4.6.19
34. Critical · 9.8 Newsletters <= 4.6.8.5 - Object Injection ↗
    2018-03-12 CVE-2018-20987 Deserialization of Untrusted Data Affects < 4.6.8.6 Patched in 4.6.8.6
35. Medium · 5.4 Newsletters <= 4.6.4.2 - Reflected Cross-Site Scripting ↗
    2017-05-29 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.6.5.2 Patched in 4.6.5.3
36. Medium · 4.9 Newsletters <= 4.6.4.2 - Directory Traversal ↗
    2017-05-29 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 4.6.4.2 Patched in 4.6.4.3

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-07-27 3K+ → 2K+ down after 943 days in tier
2. 2022-12-27 4K+ → 3K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Email Marketing Plugin – WP Email Capture 1K+ installs · 4.2★ · 2 shared tags B
• Contact Form 7 GetResponse Extension 1K+ installs · 4.0★ · 2 shared tags B
• Mailster Gravity Forms 800+ installs · 4.0★ · 2 shared tags D
• NewsmanApp 500+ installs · 3.9★ · 2 shared tags B
• WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin 4M+ installs · 4.8★ · 1 shared tag A
• MC4WP: Mailchimp for WordPress 1M+ installs · 4.8★ · 1 shared tag A

Embed this report card

Drop a live Pulse card for Newsletters into a readme, a review or a deck. It updates itself.

Newsletters: 2K+ active installs, 4.6★ (245 reviews). Plugin Pulse (WP Mayor), as of 2026-08-28. https://plugins.wpmayor.com/plugin/newsletters-lite