CVE-2026-96566: Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter

Q: Which installations are exposed?

Installations of the Newsletter plugin through version 9.4.0 are affected. The vulnerable subscription endpoint does not require authentication, a nonce, a capability check, or CAPTCHA.

Q: What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely without an account or user interaction. They submit a crafted subscription request to the na=sa endpoint using the np1 custom-field parameter, with the {profile_1} placeholder embedded in the local part of an email address to pass email validation.

Q: When does the injected script execute?

The injected script is stored and executes when a user accesses a page containing the injected content. The available information does not identify which specific page or user role is required to trigger it.

Published Oct 2, 2026

Updated

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The subscription endpoint (na=sa) requires no nonce, no capability check, and no CAPTCHA, and the payload can be smuggled past email-address validation by embedding the {profile1} placeholder in the local part of the submitted address, since WordPress's isemail() permits curly braces there.

Affected Software

1 affected component

The Newsletter Plugin Newsletter<=9.4.0

Event History

Oct 2, 2026

CVE Published

via MITRE·07:39 AM

Data Sourced

via MITRE·07:39 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are exposed?

Installations of the Newsletter plugin through version 9.4.0 are affected. The vulnerable subscription endpoint does not require authentication, a nonce, a capability check, or CAPTCHA.

What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely without an account or user interaction. They submit a crafted subscription request to the na=sa endpoint using the np1 custom-field parameter, with the {profile_1} placeholder embedded in the local part of an email address to pass email validation.

When does the injected script execute?

The injected script is stored and executes when a user accesses a page containing the injected content. The available information does not identify which specific page or user role is required to trigger it.

CVE-2026-96566: Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter

Affected Software

Event History

Frequently Asked Questions

Which installations are exposed?

What does an attacker need to exploit this issue?

When does the injected script execute?

Company

Resources

Contact

Frequently Asked Questions

Which installations are exposed?

What does an attacker need to exploit this issue?

When does the injected script execute?