Newsletters 4.15 Release Notes

Release notes for version 4.15 of the WordPress Newsletter plugin.

This is a small update. We are preparing a larger v5.0 update with new features and improvements. Coming soon!

Fixed

• Fixed reflected XSS on the Autoresponder Emails admin page by properly escaping `id` and `status` query values before outputting them inside inline JavaScript.
• Fixed incomplete CVE-2025-67911 remediation by preventing PHP object instantiation when rendering serialized subscriber custom-field values in newsletter personalization. Reported by Yaswanth Reddy Sunkara.
• Fixed stored XSS in the admin subscriber view by sanitizing subscriber referrer URLs before storage and escaping them before output.