Chandle

I dig a little bit deeper and maybe a better fix (than modifying stats.php file as described in my original post) is to fix it in wysija-newsletters/helpers/mailer.php file:

Find:

$urlencoded=urlencode(base64_encode($v));

Replace with:

$urlencoded=urlencode(base64_encode(html_entity_decode($v)));

Find:

$urlencoded=urlencode(base64_encode($urlreuse));

Replace with:

$urlencoded=urlencode(base64_encode(html_entity_decode($urlreuse)));

It seems a solution for this is to open wysija-newsletters/controllers/front/stats.php file and

Find:

$this->redirect($decodedUrl);

and replace with:

$this->redirect(html_entity_decode($decodedUrl));

Why closed?

Just reverting to v10.1.5 and removing authors permissions would be enough. It is fairly good plugin!

Btw guys I am using WP for years and I had to register second ago because I only needed to report this.
There should be a “Report phishing” button or something like that at plugin page… we are in 2012 – such things will happen again ??

Done.