Newsletters (WordPress plugin) CVE-2026-57394

Exploitation requires victim user interaction (CVSS UI:R): the target must open an attacker-crafted URL pointing at the vulnerable Newsletters plugin endpoint, with the malicious payload supplied in a reflected request parameter. No authentication or privileges are needed on the attacker's side (PR:N), and it is remotely reachable over the network (AV:N) against sites running Newsletters <= 4.14. The key limiting factors are that the payload is reflected rather than stored (so each victim must be individually social-engineered into clicking a unique link), impact is scoped to whatever the victim's browser session can do, and value is highest when the clicking victim is an authenticated administrator.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a network-exploitable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must click or load a malicious link, which meaningfully limits mass, hands-off exploitation. The changed scope (S:C) and 7.1 score are driven by script executing in the victim's browser context rather than a direct server compromise, and the impact metrics are all Low. No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no signal of active or automated exploitation; this reads as a real but moderate, opportunistic-phishing-grade issue rather than a top-priority emergency. The reflected (not stored) nature further constrains risk because each victim must be individually delivered a crafted URL. Note: reflected XSS realistically has little to no availability impact, so the A:L in the supplied vector is arguably generous - verify against vendor scoring conventions (Patchstack tends to score C/I/A uniformly).

An attacker crafts a URL to a Newsletters plugin endpoint containing a malicious script payload in a reflected parameter and delivers it via email or a link to a logged-in site administrator. When the admin clicks it, the script executes in their authenticated session and can steal cookies, forge requests, or attempt to create a rogue admin account. No public POC was provided, but the low attack complexity makes crafting such a link straightforward for a skilled attacker.