Executive brief
The Newsletters plugin for WordPress, used for managing email marketing and subscriber lists, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the website. By tricking a user into clicking a specific link, an attacker could execute code in the user's browser, potentially leading to unauthorized actions or the theft of sensitive session information. This could compromise the integrity of the website and the security of its visitors.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Tribulant Software Newsletters (newsletters-lite) plugin for WordPress due to improper neutralization of user-supplied input during web page generation. The flaw affects versions up to and including 4.14. An unauthenticated remote attacker can exploit this by sending a specially crafted link to a user; if the user clicks the link, the malicious script is executed within the context of their browser session. This can lead to the theft of session cookies, unauthorized administrative actions, or website defacement. The issue is resolved in version 4.15.
Affected products
- Tribulant Software Newsletters (newsletters-lite) <= 4.14
Timeline
- 2026-06-10: other: Reported by researcher dutafi
- 2026-07-08: advisory: Patchstack advisory published
- 2026-07-13: disclosed: CVE published to NVD
- 2026-07-13: patched: Version 4.15 released to address the vulnerability