CVE-2026-96566 in The Newsletter Plugin
Summary
by MITRE • 10/02/2026
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The subscription endpoint (na=sa) requires no nonce, no capability check, and no CAPTCHA, and the payload can be smuggled past email-address validation by embedding the {profile_1} placeholder in the local part of the submitted address, since WordPress's is_email() permits curly braces there.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified within The Newsletter – Send awesome emails from WordPress plugin represents a critical security flaw rooted in insufficient input sanitization and output escaping mechanisms. This Stored Cross-Site Scripting (XSS) issue affects all versions of the plugin up to and including version 9.4.0. The core technical failure lies in how the application handles user-supplied data passed through the np1 custom field parameter. When an attacker submits malicious script content via this parameter, the system fails to adequately neutralize special characters or encode output before rendering it within web pages. Consequently, any page that displays information derived from this field will execute the injected scripts in the context of a victim user's browser session. This lack of proper encoding allows persistent storage of hostile code on the server side, which is then served to unsuspecting users upon subsequent visits, creating a widespread impact vector rather than a transient one-time exploit.
The operational mechanics of this exploitation are particularly concerning due to the absence of standard security controls at the subscription endpoint identified as na=sa. This specific entry point does not enforce nonce verification, meaning there is no check for valid request origins or CSRF tokens that would typically prevent unauthorized state changes. Furthermore, it lacks capability checks, allowing unauthenticated users with minimal privileges to interact with administrative functions such as adding subscribers. The validation logic also contains a significant bypass mechanism involving email address formatting. By embedding the {profile_1} placeholder within the local part of an email address string submitted during subscription, attackers can circumvent standard email validation routines. This is possible because WordPress's native is_email() function permits curly braces in the local portion of an email address, treating them as valid characters rather than potential injection vectors. This design oversight allows malicious payloads to be smuggled into the database under the guise of legitimate subscriber data.
The impact of this vulnerability extends beyond simple script execution. Stored XSS attacks can lead to severe consequences including session hijacking, where attackers steal authentication cookies to impersonate legitimate users and administrators. It also enables defacement of website content, redirection of users to malicious phishing sites, or installation of keyloggers that capture sensitive credentials entered on the site. Because the payload is stored in the database, every user who views a page containing the compromised data becomes a potential victim without needing any direct interaction with the attacker's initial exploit link. This persistence makes remediation difficult as it requires not only patching the code but also cleaning existing malicious entries from the database if they have already been injected by previous attacks.
From an industry standards perspective, this vulnerability aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under subcategories related to stored XSS where input is saved and later displayed without proper sanitization. In terms of the MITRE ATT&CK framework, this exploit maps to T1059 Command and Control via Application Layer Protocol for initial access or data exfiltration depending on payload complexity, but more directly relates to TA0004 Impact through techniques like Data Injection which facilitates further malicious activities such as credential theft (T1078 Valid Accounts) or phishing (T1566 Phishing). The lack of CSRF protection also highlights a deviation from OWASP Top 10 guidelines regarding Broken Access Control and Cross-Site Request Forgery protections.
Mitigation strategies must address both the immediate code flaws and broader architectural weaknesses. Developers should implement strict input validation that rejects any characters outside expected alphanumeric ranges for email addresses, specifically blocking curly braces if they are not part of a documented feature set requiring them. Output encoding must be applied consistently using context-aware methods such as HTML entity encoding when rendering data in web pages to ensure scripts are displayed as text rather than executed. Additionally, the subscription endpoint requires immediate hardening by implementing nonce verification for all POST requests and enforcing capability checks to restrict access to authenticated administrators only. CAPTCHA integration should also be considered to prevent automated bulk submissions that could flood databases with malicious entries. For site owners currently running vulnerable versions, upgrading to a patched version is essential, alongside auditing the database for any existing {profile_1} based injections that may have been successfully exploited prior to patching.