CVE-2026-90981: Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires the victim to be a logged-in administrator, as the antibot check auto-passes for authenticated users, routing the unsanitized payload through the administrator-visible output branch of dienow().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/newsletterto a version that resolves this vulnerability.Fixed in 9.3.8 - Compensating control
Because exploitation relies on a logged-in administrator, prevent or restrict administrator interactions for unauthenticated users (e.g., limit the ability for unauthenticated attackers to trick administrators into clicking malicious links).
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
A logged-in WordPress administrator using Newsletter version 9.3.8 or earlier is the required victim. An unauthenticated attacker must persuade that administrator to perform an action such as clicking a crafted link.
Does the attacker need a WordPress account or administrative privileges?
No. The attacker can be unauthenticated, but exploitation depends on a logged-in administrator viewing the attacker-controlled request because the antibot check auto-passes for authenticated users.
Which versions are affected?
All Newsletter plugin versions up to and including 9.3.8 are affected.