Executive brief
The Newsletters Lite plugin for WordPress, which is used to manage email marketing and newsletters, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into website pages. These scripts will automatically run in the browser of any visitor who views the affected page. This could lead to unauthorized actions being performed on behalf of site administrators or the theft of sensitive session information.
Technical details
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the post_thumbnail() method within helpers/shortcode.php. Specifically, the user-controlled '$link' shortcode attribute is concatenated directly into an HTML href attribute without being processed by functions like esc_url() or esc_attr(). This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute in the context of a user's browser whenever they visit the compromised page. The vulnerability affects all versions up to and including 4.15.
Affected products
- Tribulant Newsletters Lite up to and including 4.15
Timeline
- 2026-07-29: disclosed: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/helpers/shortcode.php
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/helpers/shortcode.php
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/helpers/shortcode.php
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/includes/checkinit.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3621582%40newsletters-lite&new=3621582%40newsletters-lite
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2ca8ab94-45b8-4705-b23b-dbc743572121?source=cve