VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 18 known issues Latest disclosed Apr 17, 2025

Arigato Autoresponder and Newsletter Vulnerabilities

Review known vulnerability records for the WordPress plugin Arigato Autoresponder and Newsletter (`bft-autoresponder`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-39594, CVE-2024-34823 and CVE-2023-47686, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
18
High or Critical
3
Patch Coverage
100%
Last Updated
Apr 21, 2025
Related Security Guides

Use these guides while reviewing Arigato Autoresponder and Newsletter fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Arigato Autoresponder and Newsletter remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
12
1. Match the Package
Confirm the installed WordPress plugin slug is bft-autoresponder before acting on any CVE from this cluster.
2. Sort by Severity
Start with 3 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
18 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2018-18461 Critical
Arbitrary File Upload remediation for Arigato Autoresponder and Newsletter

Affected range: *. Fixed version is not listed yet.

CVE-2023-25020 High
Stored Cross-Site Scripting remediation for Arigato Autoresponder and Newsletter

Affected range: Versions up to 2.7.1. Fixed version: 2.7.1.1.

CVE-2018-1002000 High
SQL Injection remediation for Arigato Autoresponder and Newsletter

Affected range: Versions up to 2.5.1.8. Fixed version: 2.5.1.9.

CVE-2023-25061 Medium
Stored Cross-Site Scripting remediation for Arigato Autoresponder and Newsletter

Affected range: Versions up to 2.7.1. Fixed version: 2.7.1.1.

Priority CVE Quick Links

Fast paths into Arigato Autoresponder and Newsletter CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
18
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2018-18461
Arigato Autoresponder and Newsletter <= 2.7 - Arbitrary File Upload
 Arbitrary File Upload * No patch listed CVSS 9.8
CVE-2023-25020
Arigato Autoresponder and Newsletter <= 2.7.1 - Unauthenticated Stored Cross-Site Sc...
 Stored Cross-Site Scripting Versions up to 2.7.1 2.7.1.1 CVSS 7.2
CVE-2018-1002000
Arigato Autoresponder and Newsletter <= 2.5.1.8 - SQL Injection
 SQL Injection Versions up to 2.5.1.8 2.5.1.9 CVSS 7.2
CVE-2023-25061
Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Contributor+) Stored...
 Stored Cross-Site Scripting Versions up to 2.7.1 2.7.1.1 CVSS 6.4
CVE-2025-39594
Arigato Autoresponder and Newsletter <= 2.7.2.4 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 2.7.2.4 2.7.2.5 CVSS 6.1
CVE-2018-1002003
Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 2.5.1.8 2.5.1.9 CVSS 6.1
CVE-2018-1002007
Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 2.5.1.8 2.5.1.9 CVSS 6.1
CVE-2018-1002008
Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 2.5.1.8 2.5.1.9 CVSS 6.1
CVE-2018-18461 Critical No patch listed
CVE-2018-18461 Arigato Autoresponder and Newsletter Arbitrary File Upload

Arigato Autoresponder and Newsletter <= 2.7 - Arbitrary File Upload

CVE-2023-25020 High 2.7.1.1
CVE-2023-25020 Arigato Autoresponder and Newsletter Stored Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting

CVE-2018-1002000 High 2.5.1.9
CVE-2018-1002000 Arigato Autoresponder and Newsletter SQL Injection

Arigato Autoresponder and Newsletter <= 2.5.1.8 - SQL Injection

CVE-2023-25061 Medium 2.7.1.1
CVE-2023-25061 Arigato Autoresponder and Newsletter Stored Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2025-39594 Medium 2.7.2.5
CVE-2025-39594 Arigato Autoresponder and Newsletter Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.7.2.4 - Reflected Cross-Site Scripting

CVE-2018-1002003 Medium 2.5.1.9
CVE-2018-1002003 Arigato Autoresponder and Newsletter Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting

CVE-2018-1002007 Medium 2.5.1.9
CVE-2018-1002007 Arigato Autoresponder and Newsletter Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting

CVE-2018-1002008 Medium 2.5.1.9
CVE-2018-1002008 Arigato Autoresponder and Newsletter Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Arigato Autoresponder and Newsletter so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
18 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
1 critical and 2 high severity findings.
Recent CVEs
CVE-2025-39594, CVE-2024-34823 and CVE-2023-47686
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Arigato Autoresponder and Newsletter

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-39594
CVE-2025-39594: Arigato Autoresponder and Newsletter <= 2.7.2.4 - Reflected Cross-Site Scripting

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbit...

Published
Apr 17, 2025
Patched Release
2.7.2.5
Affected Versions
Versions up to 2.7.2.4
Next Step
Update to 2.7.2.5 or newer if supported.
Review CVE-2025-39594 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-34823
CVE-2024-34823: Arigato Autoresponder and Newsletter <= 2.7.2.3 - Cross-Site Request Forgery

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2.3. This is due to missing or incorrect nonce validation on the contact_form() function. This makes it possible for unauthenticated...

Published
May 09, 2024
Patched Release
2.7.2.4
Affected Versions
Versions up to 2.7.2.3
Next Step
Update to 2.7.2.4 or newer if supported.
Review CVE-2024-34823 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-47686
CVE-2023-47686: Arigato Autoresponder and Newsletter <= 2.7.2.2 - Cross-Site Request Forgery

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.2.2. This is due to missing or incorrect nonce validation on the bft_log() function. This makes it possible for unauthenticated attacker...

Published
Nov 09, 2023
Patched Release
2.7.2.3
Affected Versions
Versions up to 2.7.2.2
Next Step
Update to 2.7.2.3 or newer if supported.
Review CVE-2023-47686 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-25031
CVE-2023-25031: Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-lev...

Published
Feb 06, 2023
Patched Release
2.7.1.1
Affected Versions
Versions up to 2.7.1
Next Step
Update to 2.7.1.1 or newer if supported.
Review CVE-2023-25031 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2023-25020
CVE-2023-25020: Arigato Autoresponder and Newsletter <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

Published
Feb 06, 2023
Patched Release
2.7.1.1
Affected Versions
Versions up to 2.7.1
Next Step
Update to 2.7.1.1 or newer if supported.
Review CVE-2023-25020 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-25061
CVE-2023-25061: Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level...

Published
Feb 02, 2023
Patched Release
2.7.1.1
Affected Versions
Versions up to 2.7.1
Next Step
Update to 2.7.1.1 or newer if supported.
Review CVE-2023-25061 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-0543
CVE-2023-0543: Arigato Autoresponder and Newsletter <= 2.1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$user->email’ parameter in versions up to, and including, 2.1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

Published
Jan 31, 2023
Patched Release
2.1.7.2
Affected Versions
Versions up to 2.1.7.1
Next Step
Update to 2.1.7.2 or newer if supported.
Review CVE-2023-0543 fixed version details Open CVE Reference
Plugin Critical Patched: No CVE-2018-18461
CVE-2018-18461: Arigato Autoresponder and Newsletter <= 2.7 - Arbitrary File Upload

The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments[] data to models/attachment.php.This plugin does not appear to be patched based on our review.

Published
Oct 17, 2018
Patched Release
Not published
Affected Versions
*
Next Step
Open the full report for remediation notes and references.
Review CVE-2018-18461 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2018-1002000
CVE-2018-1002000: Arigato Autoresponder and Newsletter <= 2.5.1.8 - SQL Injection

There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST request.

Published
Sep 18, 2018
Patched Release
2.5.1.9
Affected Versions
Versions up to 2.5.1.8
Next Step
Update to 2.5.1.9 or newer if supported.
Review CVE-2018-1002000 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2018-1002003
CVE-2018-1002003: Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.

Published
Sep 18, 2018
Patched Release
2.5.1.9
Affected Versions
Versions up to 2.5.1.8
Next Step
Update to 2.5.1.9 or newer if supported.
Review CVE-2018-1002003 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2018-1002007
CVE-2018-1002007: Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id.

Published
Sep 18, 2018
Patched Release
2.5.1.9
Affected Versions
Versions up to 2.5.1.8
Next Step
Update to 2.5.1.9 or newer if supported.
Review CVE-2018-1002007 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2018-1002006
CVE-2018-1002006: Arigato Autoresponder and Newsletter <= 2.5.1.8 - Cross-Site Scripting

These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes

Published
Sep 18, 2018
Patched Release
2.5.1.9
Affected Versions
Versions up to 2.5.1.8
Next Step
Update to 2.5.1.9 or newer if supported.
Review CVE-2018-1002006 fixed version details Open CVE Reference