Newsletter Plugin CVE-2026-90981

Exploitation requires the victim to be a currently logged-in WordPress administrator on a site running The Newsletter Plugin version 9.3.8 or earlier; the malicious 'nn' parameter payload only reaches the vulnerable output branch of dienow() because the plugin's antibot/antispam check auto-passes authenticated users, so anonymous or non-admin victims do not trigger the reflected output. The attacker themselves needs no authentication (PR:N) but must socially engineer the admin into clicking a crafted link (UI:R). These two gates - admin-only victim and required user interaction - substantially limit real-world exploitability despite the network attack vector.

This is a genuine but contained issue rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1 Medium) shows a network-reachable, low-complexity reflected XSS requiring victim interaction, which is standard for this bug class. The critical mitigating factor - stated explicitly in the description and NOT reflected in the raw score - is that exploitation only succeeds against a victim who is a logged-in WordPress administrator, because the antibot check auto-passes authenticated users and routes the unsanitized 'nn' payload through the administrator-visible output branch of dienow(); an anonymous or non-admin victim does not reach the vulnerable output path. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation. Reflected XSS is inherently targeted (requires per-victim social engineering) rather than wormable, and the admin-victim precondition narrows the realistic target set further. Net: real and worth patching on popular installs given the high plugin footprint, but it is a high-prevalence-product / moderate-real-risk item, not a drop-everything emergency. No signals are directly conflicting; the main caveat is that no fixed version is stated in the input (all versions through 9.3.8 are listed as affected), so the remediation target should be verified against the vendor changeset.

An unauthenticated attacker crafts a URL to a Newsletter plugin endpoint with a malicious script in the 'nn' parameter and sends it (phishing/DM) to a site administrator who is currently logged in. When the admin clicks the link, the antibot check auto-passes their authenticated session and the reflected payload executes in their browser in the wp-admin context, enabling session/action abuse. No public exploit code was identified at time of analysis.