Newsletters

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

107 searches this plugin appeared in over the last 90 days, 17 listed. 90 left out as unrelated or noise (years, numbers, stray words). 3 of its tags aren't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 15 months ago; the previous band took 2.6 years to cross, which places it about 51% of the way through.

1. ★★★★★ Justin

   5mo ago

   Nowhere did I see the 500 subscriber limit, not until I investigated the logs when I wondered why it wasn’t sending. Uninstalling.

   Read on wp.org ↗
2. ★★★★★ wpvolker1

   9mo ago

   can recommend.

   Read on wp.org ↗
3. ★★★★★ imijam

   1.2y ago

   Great plugin with excellent support! This is one of the few newsletter plugins that works well and allows you to send PDF attachments with your message. Recently, we encountered a problem sending newsletters. We couldn’t figure it out and contacted Tribulant for advice. The support team was very friendly and quickly resolved the issue.

   Read on wp.org ↗
4. ★★★★★ gutte

   1.5y ago

   I have used this plugin for quite some time. But it was tiresome to set up and to customize. And I newer really was sure how the newsletters would show up when received by customers. I tested it, but sometimes the header would not show up.I finally left it and opted by a online newsletter/email system, that is sooo much easier to handle. This topic was modified 1 year, 2 months ago by gutte. This topic was modified 1 year, 2 months ago by gutte.

   Read on wp.org ↗
5. ★★★★★ gattodigital

   3.1y ago

   Not happy with the harrassing notice every time I log in to WordPress to leave a review. Also, the output HTML is extremely junky. Other than that, the free version more or less meets functionality.

   Read on wp.org ↗
6. ★★★★★ herbert

   3.3y ago

   Had a problem with the plugin, got some strange errors on cloning newsletters with content areas and also on sending through Mailgun api. Opened ticket in Tribulant support and after a good week they had it fixed. Great service.

   Read on wp.org ↗
7. ★★★★★ dave10001

   3.5y ago

   I’m rooting for this one to get better. When functional, it can be good. That said, its functionality has proved to be rather volatile at times. Regarding customer service, there’s room for improvement. I have received some help from them and it’s been appreciated when it came through. That said, the predictability of timely responses isn’t there. That can be frustrating when issues arise (and they often do). This topic was modified 3 years, 2 months ago by dave10001. This topic was modified 3 years, 2 months ago by dave10001. This topic was modified 3 years, 1 month ago by dave10001. This topic was modified 3 years, 1 month ago by dave10001. This topic was modified 3 years, 1 month ago by dave10001. This topic was modified 3 years ago by dave10001. This topic was modified 3 years ago by dave10001. This topic was modified 3 years ago by dave10001.

   Read on wp.org ↗
8. ★★★★★ vagtech

   3.5y ago

   Our email system has been through many different companies trying to get out of spam folders and into the inbox. all of them said they guaranteed results. but the only results were to be listed on spam lists because of shared IP address or entire IP blocks being listed and we just happen to be in a bad IP network. once we started using Tribulant our numbers to the inbox almost quadrupled because we were using our own server and not a service. And after their support team showed us how our site was slow and how to fix it, along with the updates they have helped us with regarding our send rate issues, i couldn’t be happier with the software or their service. we have even transferred from our old hosting service to tribulants hosting for a much faster and flexible system then our old expensive “daddy”. as to the software itself… its very flexible and has many features that more expensive services do not have. the ability to use your hosting server or an external smtp server for sending makes it useable if you already have a SMTP service you send through. the bounce and unsubscribe features are automatic when setup correctly and make you fully compliant with the BIG 4 mail services (gmail, aol, hotmail, and yahoo) along with all the rest as far as removal of unhappy recipients. The Newsletter Creator is simple to learn and use as well as fully customizable to make it look and feel like a part of your website…or be something completely new each mail you send. the mailing lists being a separate list than the website user list was a major factor for us but its ability to link to a site user would be very useful in others cases. stuff i haven’t even got to tinker with yet are the ability to customize the sign up and list management pages for the subscribers. or the subscription to multiple lists for different send rates (day/week/month) or products or whatever… and the cost makes it a tool that can grow as you do and not kill your bank account just to try. and the MANY more features i haven’t list here, are the reason im leaving this long review. I hope this helps someone make a decision… because Tribulant helped us, Im sure they could help you.

   Read on wp.org ↗

1 open vulnerability affects the current version (4.18.2). 44 of 45 disclosed are patched.

1. Patched Medium · 5.3 Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter ↗
   2026-10-30 CVE-2026-101325 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.18.1 Patched in 4.18.2
2. Open Medium · 4.3 Newsletters <= 4.18.2 - Cross-Site Request Forgery ↗
   2026-10-27 CVE-2026-116863 Cross-Site Request Forgery Affects <= 4.18.2 No patch available
3. Patched High · 8.1 Newsletters <= 4.18.1 - Unauthenticated PHP Object Injection ↗
   2026-10-22 CVE-2026-94075 Deserialization of Untrusted Data Affects <= 4.18.1 Patched in 4.18.2
4. Patched High · 7.5 Newsletters <= 4.18.1 - Unauthenticated SQL Injection ↗
   2026-10-22 CVE-2026-111402 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.18.1 Patched in 4.18.2
5. Patched Medium · 5.3 Newsletters <= 4.18.0 - Unauthenticated Insecure Direct Object Reference ↗
   2026-09-21 CVE-2026-16264 Authorization Bypass Through User-Controlled Key Affects <= 4.18.0 Patched in 4.18.1
6. Patched Medium · 4.9 Newsletters <= 4.18 - Authenticated (Administrator+) SQL Injection ↗
   2026-09-17 CVE-2026-66619 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.18 Patched in 4.18.1
7. Patched Medium · 4.3 Newsletters < 4.17 - Cross-Site Request Forgery ↗
   2026-08-29 CVE-2026-17522 Cross-Site Request Forgery Affects < 4.17 Patched in 4.17
8. Patched Medium · 5.3 Newsletters < 4.17 - Insufficient Authorization ↗
   2026-08-27 CVE-2026-17520 Generation of Predictable Numbers or Identifiers Affects < 4.17 Patched in 4.17
9. Patched Medium · 4.3 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter ↗
   2026-08-24 CVE-2026-75908 Missing Authorization Affects <= 4.17 Patched in 4.18
10. Patched High · 7.3 Newsletters <= 4.15 - Unauthenticated API Authorization Bypass via Type Juggling ↗
    2026-08-03 CVE-2026-16269 Improper Authorization Affects <= 4.15 Patched in 4.16
11. Patched High · 8.1 Newsletters <= 4.15 - Unauthenticated PHP Object Injection ↗
    2026-08-03 CVE-2026-16267 Deserialization of Untrusted Data Affects <= 4.15 Patched in 4.16
12. Patched High · 7.2 Newsletters <= 4.15 - Unauthenticated Server-Side Request Forgery ↗
    2026-07-30 CVE-2026-16268 Server-Side Request Forgery Affects <= 4.15 Patched in 4.16
13. Patched Medium · 6.4 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute ↗
    2026-07-28 CVE-2026-12939 Improper Neutralization of Input During Web Page Generation Affects <= 4.15 Patched in 4.16
14. Patched Medium · 6.4 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute ↗
    2026-07-28 CVE-2026-12938 Improper Neutralization of Input During Web Page Generation Affects <= 4.15 Patched in 4.16
15. Patched High · 7.2 Newsletters <= 4.14 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-07-08 CVE-2026-57394 Improper Neutralization of Input During Web Page Generation Affects <= 4.14 Patched in 4.15
16. Patched Medium · 4.3 Newsletters <= 4.13 - Missing Authorization ↗
    2026-06-26 CVE-2026-57645 Missing Authorization Affects <= 4.13 Patched in 4.14
17. Patched High · 8.1 Newsletters <= 4.14 - Unauthenticated PHP Object Injection ↗
    2026-06-23 CVE-2026-12583 Deserialization of Untrusted Data Affects <= 4.14 Patched in 4.15
18. Patched Medium · 5.3 Newsletters <= 4.13 - Missing Authorization ↗
    2026-06-18 CVE-2026-54840 Missing Authorization Affects <= 4.13 Patched in 4.14
19. Patched High · 7.5 Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter ↗
    2026-06-09 CVE-2026-3018 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.13 Patched in 4.14
20. Patched High · 8.1 Newsletters <= 4.11 - Unauthenticated PHP Object Injection ↗
    2025-12-31 CVE-2025-67911 Deserialization of Untrusted Data Affects <= 4.11 Patched in 4.12
21. Patched Medium · 6.4 Newsletters <= 4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-12-28 CVE-2025-69020 Improper Neutralization of Input During Web Page Generation Affects <= 4.12 Patched in 4.13
22. Patched High · 8.1 Newsletters <= 4.10 - Unauthenticated Local File Inclusion ↗
    2025-07-29 CVE-2025-54034 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 4.10 Patched in 4.11
23. Patched Medium · 4.3 Newsletters <= 4.10 - Cross-Site Request Forgery ↗
    2025-07-16 CVE-2025-54035 Cross-Site Request Forgery Affects <= 4.10 Patched in 4.11
24. Patched High · 7.2 Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion ↗
    2025-05-30 CVE-2025-4857 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.9.9.9 Patched in 4.10
25. Patched Medium · 6.5 Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter ↗
    2025-05-12 CVE-2025-3107 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.9.9.8 Patched in 4.9.9.9
26. Patched Medium · 4.9 Newsletters <= 4.9.9.7 - Authenticated (Administrator+) SQL Injection ↗
    2025-03-27 CVE-2025-30921 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.9.9.7 Patched in 4.9.9.8
27. Patched High · 7.2 Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting ↗
    2025-03-25 CVE-2025-2009 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.9.7 Patched in 4.9.9.8
28. Patched Medium · 6.1 Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter ↗
    2025-03-21 CVE-2024-13739 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.9.7 Patched in 4.9.9.8
29. Patched Medium · 6.1 Newsletters <= 4.9.9.6 - Reflected Cross-Site Scripting ↗
    2024-12-26 CVE-2025-24599 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.9.6 Patched in 4.9.9.7
30. Patched Medium · 6.4 Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode ↗
    2024-10-28 CVE-2024-10181 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.9.4 Patched in 4.9.9.5
31. Patched Medium · 6.1 Newsletters <= 4.9.9.1 - Reflected Cross-Site Scripting ↗
    2024-09-27 CVE-2024-47346 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.9.1 Patched in 4.9.9.2
32. Patched High · 8.8 Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation ↗
    2024-09-05 CVE-2024-8247 Improper Privilege Management Affects <= 4.9.9.2 Patched in 4.9.9.3
33. Patched Medium · 6.1 Newsletters <= 4.9.8 - Reflected Cross-Site Scripting ↗
    2024-08-16 CVE-2024-43279 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.8 Patched in 4.9.9
34. Patched Medium · 5.3 Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure ↗
    2024-08-14 CVE-2024-7411 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.9.9 Patched in 4.9.9.1
35. Patched Medium · 4.3 Newsletters <= 4.9.7 - Cross-Site Request Forgery ↗
    2024-06-21 CVE-2024-37227 Cross-Site Request Forgery Affects <= 4.9.7 Patched in 4.9.8
36. Patched Medium · 6.1 Newsletters <= 4.9.5 - Reflected Cross-Site Scripting ↗
    2024-06-06 CVE-2024-35718 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.5 Patched in 4.9.6
37. Patched Medium · 5.3 Newsletters <= 4.9.5 - Information Exposure via Log files ↗
    2024-04-22 CVE-2024-32953 Insertion of Sensitive Information into Log File Affects <= 4.9.5 Patched in 4.9.6
38. Patched Critical · 9.1 Newsletters <= 4.9.5 - Authenticated (Admin+) Arbitrary File Upload ↗
    2024-04-22 CVE-2024-32954 Unrestricted Upload of File with Dangerous Type Affects <= 4.9.5 Patched in 4.9.6
39. Patched Medium · 6.6 Newsletter Lite <= 4.9.2 - Authenticated (Admin+) Command Injection ↗
    2023-10-05 CVE-2023-4797 Improper Neutralization of Special Elements used in an OS Command Affects <= 4.9.2 Patched in 4.9.3
40. Patched Medium · 5.4 Newsletters <= 4.8.8 - Cross-Site Request Forgery ↗
    2023-04-13 CVE-2023-30478 Cross-Site Request Forgery Affects <= 4.8.8 Patched in 4.8.9
41. Patched High · 8.8 Newsletters <= 4.6.18 - Directory Traversal ↗
    2019-07-01 CVE-2019-14788 Improper Limitation of a Pathname to a Restricted Directory Affects < 4.6.19 Patched in 4.6.19
42. Patched Medium · 5.4 Newsletters <= 4.6.18 - Cross-Site Scripting via contentarea Parameter ↗
    2019-07-01 CVE-2019-14787 Improper Neutralization of Input During Web Page Generation Affects < 4.6.19 Patched in 4.6.19
43. Patched Critical · 9.8 Newsletters <= 4.6.8.5 - Object Injection ↗
    2018-03-12 CVE-2018-20987 Deserialization of Untrusted Data Affects < 4.6.8.6 Patched in 4.6.8.6
44. Patched Medium · 5.4 Newsletters <= 4.6.4.2 - Reflected Cross-Site Scripting ↗
    2017-05-29 Improper Neutralization of Input During Web Page Generation Affects <= 4.6.5.2 Patched in 4.6.5.3
45. Patched Medium · 4.9 Newsletters <= 4.6.4.2 - Directory Traversal ↗
    2017-05-29 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.6.4.2 Patched in 4.6.4.3

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-07-27 3K+ → 2K+ down after 943 days in tier
2. 2022-12-27 4K+ → 3K+ down after 497 days in tier
3. 2021-08-17 5K+ → 4K+ down after 330 days in tier
4. 2020-09-21 6K+ → 5K+ down after 430 days in tier
5. 2019-07-19 8K+ → 6K+ down after 104 days in tier
6. 2019-04-06 9K+ → 8K+ down after 509 days in tier
7. 2017-11-13 8K+ → 9K+ up after 128 days in tier
8. 2017-07-08 9K+ → 8K+ down after 201 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Newsletters into a readme, a review or a deck. It updates itself.

Newsletters: 2K+ active installs, 4.7★ (246 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/newsletters-lite