CVE-2026-111830: WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability
Published Oct 22, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.
Affected Software
1 affected component
WP Mailster WP Mailster<=1.9.1.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Mailster (wp-mailster)to a version that resolves this vulnerability.Fixed in 1.9.2.0
Event History
Oct 22, 2026
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are in scope?
WP Mailster versions through 1.9.1.0 are affected. The available data does not identify a fixed version.
2
What access does an attacker need?
The vulnerability is remotely reachable and requires no privileges, but exploitation requires user interaction. It is a stored XSS issue with low confidentiality, integrity, and availability impact, and its impact can extend beyond the vulnerable component.