What is the CVSS score of CVE-2026-57394?

CVE-2026-57394 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Newsletters (WordPress plugin) are affected by CVE-2026-57394?

The Tribulant Newsletters WordPress plugin (versions through 4.14) contains a reflected cross-site scripting vulnerability allowing attackers to execute arbitrary JavaScript in administrator…

How to fix or mitigate CVE-2026-57394?

Within 24 hours, audit all WordPress installations to identify use of Tribulant Newsletters plugin (newsletters-lite) version 4.14 or earlier and assess its operational criticality. Within 7 days, either deactivate and remove the plugin entirely if operational requirements permit, or implement compensating controls including IP-based access restrictions to WordPress administration panels, mandatory multi-factor authentication for all administrator accounts, and deployment of WordPress security plugins with web application firewall capabilities to filter reflected XSS payloads. Within 30 days, establish monitoring of Tribulant Software and Patchstack security advisories, document this vulnerability in your WordPress security baseline, and create a policy requiring security plugin updates within 48 hours of vendor release.

Newsletters (WordPress plugin) CVE-2026-57394

EUVD-2026-43466 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

XSS Newsletters WordPress Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Remote unauthenticated reflected XSS needing victim click (UI:R), executing in browser origin so S:C with low C/I; reflected XSS has no real availability impact, hence A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:01 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.14.

AnalysisAI

Reflected cross-site scripting in the Tribulant Software Newsletters (newsletters-lite) WordPress plugin, affecting all versions up through 4.14, lets a remote attacker execute arbitrary JavaScript in a victim's browser when the victim is lured into clicking a crafted link. Reported by Patchstack and rated CVSS 7.1, the scope-changing flaw can lead to session/credential theft or actions performed as the targeted user, including administrators. There is no public exploit identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

The affected component is Newsletters (newsletters-lite), a WordPress email/newsletter management plugin from Tribulant Software, identified by CPE cpe:2.3:a:tribulant_software:newsletters:*:*:*:*:*:*:*:*. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, specifically the reflected variant: user-supplied input (typically a request parameter) is echoed back into an HTML response without proper output encoding or contextual escaping, so the browser parses attacker-controlled data as executable markup/script. Because this is a WordPress plugin, the injected script runs in the origin of the WordPress site, giving it access to that site's DOM, cookies, and authenticated session context.

RemediationAI

No vendor-released patch version was identified in the provided data; the description states the issue affects versions through <= 4.14 without naming a fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-14-cross-site-scripting-xss-vulnerability) and upgrade to any release later than 4.14 as soon as one is confirmed available. Until a fixed version is verified, apply compensating controls: deploy a WordPress-aware WAF or virtual patch (Patchstack/Wordfence-style rules) to filter the reflected XSS payload on the affected endpoint, restrict or monitor access to the plugin's public request handlers, and enforce a restrictive Content-Security-Policy to reduce the impact of injected inline script (trade-off: a strict CSP can break legitimate inline scripts and require tuning). Educate administrators and subscribers not to click untrusted newsletter/plugin links, since exploitation depends on user interaction.