Demander un audit

Retour à la veille

CVE-2026-96566

Publié : 2 octobre 2026

Modifié : 2 octobre 2026

Lien officiel NVD

Score CVSS

7.2

HIGH

Description détaillée

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The subscription endpoint (na=sa) requires no nonce, no capability check, and no CAPTCHA, and the payload can be smuggled past email-address validation by embedding the {profile_1} placeholder in the local part of the submitted address, since WordPress's is_email() permits curly braces there.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/includes/classes.php#L212 https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/includes/module-base.php#L1032 https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/includes/module.php#L1006 https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/plugin.php#L457 https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/profile/profile.php#L511 https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/subscription/subscription.php#L257 https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/subscription/subscription.php#L723 https://plugins.trac.wordpress.org/changeset?reponame=&old=3711290%40newsletter&new=3711290%40newsletter https://www.wordfence.com/threat-intel/vulnerabilities/id/6e61119c-b83e-41b4-aa14-7dc61086520d?source=cve

Dernières Vulnérabilités

CVE-2026-96294

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-96292

Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-96288

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.