CVE-2026-115821: NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters
The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingfirstname, billinglastname' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is configured in the plugin settings.
Affected Software
Event History
Frequently Asked Questions
What configurations are exposed to exploitation?
Only installations with the Newsman Remarketing feature enabled and a non-empty Remarketing ID configured are exploitable. Installations without that feature enabled or without a configured Remarketing ID are not exploitable under the stated conditions.
Does an attacker need an account or user interaction to inject the payload?
No. The issue can be exploited by an unauthenticated attacker, with low attack complexity and no user interaction required for injection. The stored script executes later when a user accesses an injected page.
Which versions are affected?
All NewsmanApp plugin for WordPress versions through 3.7.29, including 3.7.29, are affected.