VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 18 known issues Latest disclosed Apr 17, 2025

Arigato Autoresponder and Newsletter Vulnerabilities

Review known vulnerability records for the WordPress plugin Arigato Autoresponder and Newsletter (`bft-autoresponder`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-39594, CVE-2024-34823 and CVE-2023-47686, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
18
High or Critical
3
Patch Coverage
100%
Last Updated
Apr 21, 2025
Priority CVE Quick Links

Fast paths into Arigato Autoresponder and Newsletter CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
18
CVE-2018-18461 Critical No patch listed
CVE-2018-18461 Arigato Autoresponder and Newsletter Arbitrary File Upload

Arigato Autoresponder and Newsletter <= 2.7 - Arbitrary File Upload

CVE-2023-25020 High 2.7.1.1
CVE-2023-25020 Arigato Autoresponder and Newsletter Stored Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting

CVE-2018-1002000 High 2.5.1.9
CVE-2018-1002000 Arigato Autoresponder and Newsletter SQL Injection

Arigato Autoresponder and Newsletter <= 2.5.1.8 - SQL Injection

CVE-2023-25061 Medium 2.7.1.1
CVE-2023-25061 Arigato Autoresponder and Newsletter Stored Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2025-39594 Medium 2.7.2.5
CVE-2025-39594 Arigato Autoresponder and Newsletter Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.7.2.4 - Reflected Cross-Site Scripting

CVE-2018-1002003 Medium 2.5.1.9
CVE-2018-1002003 Arigato Autoresponder and Newsletter Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting

CVE-2018-1002007 Medium 2.5.1.9
CVE-2018-1002007 Arigato Autoresponder and Newsletter Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting

CVE-2018-1002008 Medium 2.5.1.9
CVE-2018-1002008 Arigato Autoresponder and Newsletter Cross-Site Scripting

Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Arigato Autoresponder and Newsletter so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
18 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
1 critical and 2 high severity findings.
Recent CVEs
CVE-2025-39594, CVE-2024-34823 and CVE-2023-47686
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Arigato Autoresponder and Newsletter

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-39594
CVE-2025-39594: Arigato Autoresponder and Newsletter <= 2.7.2.4 - Reflected Cross-Site Scripting

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbit...

Published
Apr 17, 2025
Patched Release
2.7.2.5
Affected Versions
Versions up to 2.7.2.4
Next Step
Update to 2.7.2.5 or newer if supported.
Open CVE-2025-39594 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-34823
CVE-2024-34823: Arigato Autoresponder and Newsletter <= 2.7.2.3 - Cross-Site Request Forgery

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2.3. This is due to missing or incorrect nonce validation on the contact_form() function. This makes it possible for unauthenticated...

Published
May 09, 2024
Patched Release
2.7.2.4
Affected Versions
Versions up to 2.7.2.3
Next Step
Update to 2.7.2.4 or newer if supported.
Open CVE-2024-34823 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-47686
CVE-2023-47686: Arigato Autoresponder and Newsletter <= 2.7.2.2 - Cross-Site Request Forgery

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.2.2. This is due to missing or incorrect nonce validation on the bft_log() function. This makes it possible for unauthenticated attacker...

Published
Nov 09, 2023
Patched Release
2.7.2.3
Affected Versions
Versions up to 2.7.2.2
Next Step
Update to 2.7.2.3 or newer if supported.
Open CVE-2023-47686 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-25031
CVE-2023-25031: Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-lev...

Published
Feb 06, 2023
Patched Release
2.7.1.1
Affected Versions
Versions up to 2.7.1
Next Step
Update to 2.7.1.1 or newer if supported.
Open CVE-2023-25031 Report Open CVE Reference
Plugin High Patched: Yes CVE-2023-25020
CVE-2023-25020: Arigato Autoresponder and Newsletter <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

Published
Feb 06, 2023
Patched Release
2.7.1.1
Affected Versions
Versions up to 2.7.1
Next Step
Update to 2.7.1.1 or newer if supported.
Open CVE-2023-25020 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-25061
CVE-2023-25061: Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level...

Published
Feb 02, 2023
Patched Release
2.7.1.1
Affected Versions
Versions up to 2.7.1
Next Step
Update to 2.7.1.1 or newer if supported.
Open CVE-2023-25061 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-0543
CVE-2023-0543: Arigato Autoresponder and Newsletter <= 2.1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Arigato Autoresponder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$user->email’ parameter in versions up to, and including, 2.1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

Published
Jan 31, 2023
Patched Release
2.1.7.2
Affected Versions
Versions up to 2.1.7.1
Next Step
Update to 2.1.7.2 or newer if supported.
Open CVE-2023-0543 Report Open CVE Reference
Plugin Critical Patched: No CVE-2018-18461
CVE-2018-18461: Arigato Autoresponder and Newsletter <= 2.7 - Arbitrary File Upload

The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments[] data to models/attachment.php.This plugin does not appear to be patched based on our review.

Published
Oct 17, 2018
Patched Release
Not published
Affected Versions
*
Next Step
Open the full report for remediation notes and references.
Open CVE-2018-18461 Report Open CVE Reference
Plugin High Patched: Yes CVE-2018-1002000
CVE-2018-1002000: Arigato Autoresponder and Newsletter <= 2.5.1.8 - SQL Injection

There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST request.

Published
Sep 18, 2018
Patched Release
2.5.1.9
Affected Versions
Versions up to 2.5.1.8
Next Step
Update to 2.5.1.9 or newer if supported.
Open CVE-2018-1002000 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2018-1002003
CVE-2018-1002003: Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.

Published
Sep 18, 2018
Patched Release
2.5.1.9
Affected Versions
Versions up to 2.5.1.8
Next Step
Update to 2.5.1.9 or newer if supported.
Open CVE-2018-1002003 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2018-1002007
CVE-2018-1002007: Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id.

Published
Sep 18, 2018
Patched Release
2.5.1.9
Affected Versions
Versions up to 2.5.1.8
Next Step
Update to 2.5.1.9 or newer if supported.
Open CVE-2018-1002007 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2018-1002006
CVE-2018-1002006: Arigato Autoresponder and Newsletter <= 2.5.1.8 - Cross-Site Scripting

These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes

Published
Sep 18, 2018
Patched Release
2.5.1.9
Affected Versions
Versions up to 2.5.1.8
Next Step
Update to 2.5.1.9 or newer if supported.
Open CVE-2018-1002006 Report Open CVE Reference