Executive brief
The Newsletters Lite plugin for WordPress, which is used to manage email marketing and newsletters, contains a security flaw that allows users with basic contributor permissions to inject malicious scripts into website pages. When other users or administrators visit these affected pages, the scripts can execute automatically, potentially leading to unauthorized actions or data theft. This vulnerability impacts all versions of the plugin up to and including 4.15.
Technical details
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the posts_single() function. Specifically, an attacker-controlled 'target' attribute in the [newsletters_post] shortcode is propagated into the global $wpml_target variable. This variable is subsequently concatenated into a target="..." HTML attribute within the shortcode_posts() 'post_thumbnail' handler without being passed through esc_attr(). Authenticated attackers with Contributor-level access or higher can exploit this to inject arbitrary web scripts that execute in the context of a user's browser when they view the affected page. A patch appears to have been addressed in a recent changeset.
Affected products
- Tribulant Newsletters Lite up to and including 4.15
Timeline
- 2026-07-29: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/helpers/shortcode.php
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/helpers/shortcode.php
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/helpers/shortcode.php
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/helpers/shortcode.php
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/includes/checkinit.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3621582%40newsletters-lite&new=3621582%40newsletters-lite
- https://www.wordfence.com/threat-intel/vulnerabilities/id/293abae5-a7fb-401f-af09-324a81ce8709?source=cve