shouldiuse.io

New check

Categories

VERDICT

Should I use The Newsletter Plugin?

The Newsletter Plugin is a complete tool to manage newsletters, straight from your Wordpress dashboard. - thenewsletterplugin.com

Depends. Choose it if you run WordPress, have a small-to-mid list, and want newsletters without monthly SaaS fees. Avoid it if deliverability is mission-critical or you won't stay on top of security updates.

Confidence

Medium. Based on ~25 public sources; many snippets truncated, so verbatim user quotes were unavailable.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityForums exist; no quality evidence found
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
PremiumPaid add-ons; sales up to 50% off

Best for

  • WordPress sites wanting free newsletters
  • Bloggers avoiding monthly SaaS fees
  • Lists up to ~10,000 subscribers
  • Teams keeping subscriber data on their own site

Not for

  • Non-WordPress sites
  • Guess: high-volume senders needing guaranteed inbox placement
  • Anyone who won't patch plugins promptly
  • Guess: teams needing advanced marketing automation and segmentation

Gotchas - check before you buy

high

Multiple 2025–2026 CVEs (XSS, CSRF, auth bypass); unpatched installs are targets

medium

Guess: self-hosted sending can land in spam; budget for SMTP setup and testing

medium

Guess: migrating to a hosted tool later means exporting lists and rebuilding forms

low

Premium is add-on bundles; frequent sales (up to 50% off) mean shifting pricing

Pros and cons

Pros

  • Free core plugin; reviewers call it the best free WordPress newsletter option
  • Manages newsletters entirely from the WordPress dashboard
  • Connects to external tools like Zoho Flow
  • WPBeginner says they use it on all their websites
  • Users discuss it for lists up to 10,000 subscribers

Cons

  • Repeated CVEs including stored XSS and auth bypass
  • 2020 vulnerabilities affected over 300,000 sites
  • Key features gated behind paid add-on bundles
  • WordPress plugins trail hosted services like Mailchimp in automation

Sources & method

Analyzed 9/21/2026 - 10 sources - Poor recent track record: multiple 2025–2026 CVEs (stored XSS, CSRF, auth bypass) on top of a 2020 flaw wave hitting 300,000+ sites. Patch fast or look elsewhere.

official x2review x4security x3news x1
  • CVE-2025-3584 — Stored XSS, Stored XSS exploitable as a JavaScript backdoor
  • CVE-2026-86824 — Auth bypass, Authentication bypass in the WordPress plugin
  • CVE-2026-86823 — CSRF, Cross-site request forgery vulnerability
  • CVE-2026-1051 — CSRF, CSRF flaw disclosed May 2026

Key stats

  • Value for money: 4/5

    Rating

  • $0

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 4/5. Strong free core; paid add-ons
  • Ease of use: 4/5. Runs inside the WordPress dashboard
  • Feature depth: 4/5. Complete newsletter tool with premium add-ons
  • Support quality. Forums exist; no quality evidence found
  • Security posture: 2/5. Multiple recent CVEs; 300K+ sites hit in 2020
  • Yes Free tier Core plugin free on WordPress.org
  • $430K/yr Est. revenue Crunchbase company profile
  • 300,000+ Sites hit by 2020 flaws Wordfence disclosure

Pricing

Free

$0

  • Newsletter management in WP dashboard
  • Subscription forms and subscriber lists

Premium

Paid add-ons; sales up to 50% off

  • Premium add-on bundles (automation, integrations)
  • Spring sale discounts promoted

Security

Poor recent track record: multiple 2025–2026 CVEs (stored XSS, CSRF, auth bypass) on top of a 2020 flaw wave hitting 300,000+ sites.

  • CVE-2025-3584 — Stored XSSStored XSS exploitable as a JavaScript backdoor⁷
  • CVE-2026-86824 — Auth bypassAuthentication bypass in the WordPress plugin⁶

Patch fast or look elsewhere.

  • CVE-2026-86823 — CSRFCross-site request forgery vulnerability
  • CVE-2026-1051 — CSRFCSRF flaw disclosed May 2026

What users say

Redditors actively debate whether it's worth it for lists from thousands to tens of thousands of subscribers, with free-tier appeal weighed against self-hosted tradeoffs.

Companies that use it

  • WPBeginner³
Full analysis

Based on ~25 public sources; many snippets truncated, so verbatim user quotes were unavailable.

Solid free WordPress newsletter tool, but a shaky security record makes it a must-patch choice.

Methodology

Based on ~25 public sources; many snippets truncated, so verbatim user quotes were unavailable.

Sources

  1. The Newsletter Plugin Review: The Best Free Option For WordPress?blogvault.net
    review
  2. MailPoet and WordPress Newsletter Plugins vs Mailchimp and Dripdeliciousbrains.com
    review
  3. Best WordPress Newsletter Plugins — WPBeginnerwpbeginner.com
    review
  4. Newsletter — WordPress.org plugin pagewordpress.org
    official
  5. Pricing — The Newsletter Pluginthenewsletterplugin.com
    official
  6. CVE-2026-86824: Newsletter Plugin Auth Bypasssentinelone.com
    security
  7. CVE-2025-3584 — Stored XSS to JS Backdoorresearch.cleantalk.org
    security
  8. Newsletter Plugin Vulnerabilities Affect Over 300,000 Siteswordfence.com
    security
  9. Is the Newsletter Plugin worth it? — Redditreddit.com
    review
  10. The Newsletter Plugin — Crunchbasecrunchbase.com
    news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.