What is the CVSS score of CVE-2026-66596?

CVE-2026-66596 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Newsletter Plugin are affected by CVE-2026-66596?

WordPress Newsletter plugin versions 9.3.3 and earlier contain an unauthenticated cross-site scripting vulnerability enabling attackers to hijack authenticated user sessions and impersonate…

How to fix or mitigate CVE-2026-66596?

Within 24 hours, audit all WordPress deployments to identify and inventory Newsletter plugin installations with their specific versions. Within 7 days, contact the vendor to confirm patch availability; if no patch exists, disable the plugin entirely or implement strict network/authentication-level access controls. Within 30 days, deploy Content-Security-Policy headers to restrict malicious script execution, configure Web Application Firewall rules to detect and block XSS payload injection, establish continuous monitoring of authentication logs and administrative actions for indicators of session hijacking, and enforce multi-factor authentication on all administrative accounts.

Newsletter Plugin CVE-2026-66596

EUVD-2026-62374 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-19 Patchstack

GHSA-wmvx-23w9-2238

WordPress XSS Newsletter Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

AV:N and PR:N confirmed unauthenticated web attack; UI:R required as victim must interact; A:N assessed since XSS does not cause availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 13:30 vuln.today

CVE Published

Aug 19, 2026 - 12:38 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.

AnalysisAI

Unauthenticated cross-site scripting in the WordPress Newsletter plugin (versions 9.3.3 and earlier) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to authenticated site visitors. With a Changed scope (S:C in the CVSS vector), the malicious script executes in the victim's browser context rather than being confined to the vulnerable plugin component, enabling session hijacking, credential theft, or administrative action impersonation. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires no authentication - the CVSS vector confirms PR:N, meaning any anonymous internet user can initiate the attack against a site running Newsletter 9.3.3 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.1 is driven primarily by the network-reachable, zero-authentication, low-complexity vector combined with a scope change - characteristics that make this easier to exploit than many higher-scored vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the Newsletter plugin to the first version released above 9.3.3 via the WordPress plugin dashboard or by downloading the latest release from the WordPress plugin repository; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/newsletter/vulnerability/wordpress-newsletter-plugin-9-3-3-cross-site-scripting-xss-vulnerability provides the authoritative fixed-version reference. … Detailed patch versions, workarounds, and compensating controls in full report.