Mailster - Email Newsletter Plugin for WordPress 4.1.18

fixed: template save and ZIP upload AJAX endpoints now block path traversal and unsafe file types
fixed: block form REST submissions no longer accept certain subscriber fields
improved: anti-flood protection now uses the direct client IP instead of forwarded headers
updated: dependencies

- This update brings stability and improvements for WordPress 7.0.
- improved: block forms now support block gaps.
- improved: block form message now visible in the editor.
- improved: block form message now supports borders and shadows.
- improved: buttons on campaign edit screen for WordPress 7.0.
- improved: visual fixes for WordPress 7.0.
- improved: Quickly copy Block Markup for block forms (next to short codes).
- improved: sanitize URLs using esc_url() for improved security.
- updated: included form patterns for WordPress 7.0.
- updated: validate form ID by ensuring it is numeric before processing in frontpage class
- updated: replace ButtonGroup with Flex component in FormSelector and EmailSelector for improved layout consistency
- updated: included form patterns for WordPress 7.0.
- removed: clean lists note on import screen.
- removed: deprecated `utf8_*` methods.
- fixed: missing conditions error on manage subscribers screen.
- fixed: missing colors on forms if block messages have a non-default color.
- fixed: form section in form blocks now displays all available forms when there are more than 10.
- updated: dependencies

- removed: eliminate remove_template method from MailsterAjax class to streamline AJAX functionality
- fixed: broken blocks on automation by adding `sprintf` function to i18n imports for better string formatting in multiple files
- improved: ensure only the latest export file is downloadable by validating the filename against stored option
- improved: modify MIME type for zip uploads and enable type testing in MailsterAjax class

- fixed: correct logic in URL validation check
- fixed: check if campaign is in a valid status before checking the content
- fixed: missing sprintf on automation edit screen
- refactored: streamline form retrieval and fallback logic in MailsterNotification class for improved readability and maintainability
- updated: bump dependencies and lock files to latest versions for improved compatibility and performance
- updated: enhance URL validation logic in MailsterFrontpage class to include campaign status checks and improve error handling
- updated: add __next40pxDefaultSize prop to various components for consistent styling across form elements

We are reaching out to inform you of a recently identified security vulnerability affecting Mailster versions 4.1.13 and below.

This issue was responsibly disclosed to us and has been addressed in the latest release. While technical details are not yet publicly available, they are scheduled to be published on 27 October, 2025. Once disclosed, the risk of exploitation will significantly increase.
You can checkout the report after the 27th here.

Action Required
To keep your website secure, please update Mailster to version 4.1.14 as soon as possible.

• With a valid license:
  Update directly from your WordPress Dashboard under Dashboard → Updates.
• Without a valid license or for manual installation:
  Download the latest version here:
  Download Mailster 4.1.14

After updating, you can confirm the new version under Plugins → Installed Plugins in your WordPress Dashboard.

Reassurance
We have no evidence that this vulnerability is being actively exploited at this time. However, we strongly encourage you to update now to ensure your site remains secure once the information becomes public.

- added: option to continue workflow on specific date delays if the date is in the past
- fixed: css: issues with some themes on the automation editor
- updated: dependencies and lock files for improved compatibility and performance

4.1.12

- added: implement installation checks and enhance default settings handling
- added: link to documentation for capabilities settings page
- added: new capability to delete campaigns with appropriate roles and help text
- added: new helpdesk links to the settings page
- refactored: improve notification template fallback and error handling
- refactored: improve SMTP configuration type casting
- refactored: improve wp_mail filter argument handling
- fixed: correct parent block references for condition blocks
- updated: enhance import functionality and UI interactions
- packages updates

fixed: improve capabilities and permissions system
updated Dependencies and Package Versions
chore: update commit message guidelines
updated: improve form block error handling
updated: refactor homepage block edit and inspector controls

- fixed: missing capability to delete campaigns in some case
- fixed: missing key in array function
- added: new capabilities `delete_private_newsletters`, `delete_published_newsletters`
- improved: alignment of elements in the automation inspector
- improved: use `ToggleGroupControl` on update custom field action for checkboxes
- package upgrades