Is there a public PoC exploit available for CVE-2026-86823?

Yes, a public proof-of-concept exploit is available for CVE-2026-86823. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-86823?

Yes, a patch is available for CVE-2026-86823. Update the affected software to the latest version immediately.

Newsletter CVE-2026-86823

EUVD-2026-80206

2026-09-16 WPScan

GHSA-xhvp-v8j9-2mrf

WordPress Information Disclosure Newsletter

Lifecycle Timeline

Patch available

Sep 16, 2026 - 07:01 EUVD

CVE Published

Sep 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber record's front-end actions.

Analysis

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Newsletter

View all

CVE-2023-27922 MEDIUM This Month POC

6.1 May 23

Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inj

CVE-2022-1756 MEDIUM This Month POC

6.1 Jun 13

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it

CVE-2021-38302 CRITICAL Act Now

9.8 Aug 13

The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection. Rated critical severity (CVSS 9.8), this vulnerab

CVE-2025-3583 MEDIUM This Month POC

4.8 May 05

The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high p

CVE-2025-3582 MEDIUM This Month POC

4.8 Jun 09

The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow h

CVE-2025-3581 MEDIUM This Month POC

4.8 Jun 09

The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting

CVE-2025-3584 MEDIUM This Month POC

4.8 Jun 03

The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which coul

CVE-2022-1889 MEDIUM This Month POC

4.8 Jun 20

The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow

CVE-2026-66596 HIGH This Week

7.1 Aug 19

Unauthenticated cross-site scripting in the WordPress Newsletter plugin (versions 9.3.3 and earlier) allows remote unaut

CVE-2024-5674 MEDIUM This Month

6.5 Jun 12

The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PH

CVE-2024-5317 MEDIUM This Month

6.4 Jun 05

The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions

CVE-2023-4772 MEDIUM This Month

6.4 Sep 07

The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletter_form' shortcode in

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2026-86823 vulnerability details – vuln.today

Back