Email Subscribers & Newsletters CVE-2026-81290

No attacker authentication is required - the CVSS PR:N metric confirms the vulnerable endpoint is accessible to unauthenticated users, consistent with public-facing WordPress plugin forms such as email subscription inputs. The primary limiting factor is mandatory victim interaction (UI:R): an authenticated user, most likely a WordPress administrator, must load a page that renders the injected payload for the script to execute. The attack does not require any non-default WordPress configuration beyond having the plugin installed and active in versions ≤ 5.9.33. Exploitation is constrained to environments where this specific plugin version is deployed and where administrators interact with affected pages; sites that have deactivated the plugin or updated beyond 5.9.33 are not affected.

The CVSS 7.1 (High) rating is supported by an AV:N/AC:L/PR:N attack path - fully network-accessible with low complexity and no authentication required - which represents a genuine threat, not a theoretical one. The mandatory user interaction (UI:R) is the sole friction point; an attacker must entice or wait for a victim (typically an administrator) to load a page carrying the payload. The scope change (S:C) elevates impact because browser-context execution can yield session tokens or trigger privileged WordPress actions. EPSS data is not available in the provided input, so probability-of-exploitation cannot be quantified numerically. The absence of both KEV listing and reported POC code moderates urgency somewhat, though the unauthenticated injection surface on a widely-installed WordPress plugin is a well-understood high-value target class - even a mid-sized municipal IT team in malbork maintaining a public-facing WordPress site with this plugin installed should treat this as a priority patch before public exploit code emerges. CVSS indicates network vector and matches the description of a web-accessible plugin form, so there is no vector conflict to flag.

An unauthenticated attacker submits a crafted request to a publicly accessible endpoint of the Email Subscribers & Newsletters plugin - such as a newsletter subscription form - embedding a JavaScript payload in an insufficiently sanitized parameter. The payload is stored or reflected such that when a WordPress administrator reviews subscriber data or navigates a plugin-generated page, the script executes in their browser, silently exfiltrating their WordPress session cookie to an attacker-controlled server and enabling full administrative account takeover. No public proof-of-concept code has been reported, but the attack pattern is well-understood for unauthenticated WordPress plugin XSS.