Newsletter plugin EUVD-2026-91248

No authentication, nonce, capability check, or CAPTCHA is required - the Newsletter plugin's public subscription endpoint (na=sa) is reachable by unauthenticated remote attackers against default installations where subscription is enabled (the plugin's core function). The specific prerequisite is supplying the payload in the 'np1' custom field while bypassing email validation by embedding the {profile_1} placeholder in the local part of the email address, since WordPress is_email() permits curly braces there. The practical limiting factor is that this is stored XSS: code executes only when a user (e.g., an administrator reviewing subscribers or a visitor loading the injected page) subsequently renders the affected page, so impact depends on a victim viewing the stored content; there is no direct server-side code execution.

This is a credible, moderately-high priority issue rather than an inflated high-CVSS score. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) is consistent with the description: a network-reachable, low-complexity, fully unauthenticated stored XSS with a scope change (script executes in the browser context of other users/admins who view the injected page). What elevates real-world concern beyond the raw number is the specific lack of controls on the injection path - Wordfence states the subscription endpoint (na=sa) requires no nonce, no capability check, and no CAPTCHA, and that the input-validation bypass is concrete and reliable (embedding the {profile_1} placeholder in the email local part to slip past WordPress is_email(), which permits curly braces there). That makes exploitation deterministic and automatable rather than theoretical. Counter-signals and gaps: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public exploit code is referenced, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified at time of analysis.' Impact is also bounded - C:L/I:L/A:N reflects XSS consequences (session/cookie theft, admin-action forgery, defacement) rather than direct server compromise. Net: a real and easily-triggered vulnerability in a popular plugin that should be patched promptly, but not currently evidenced as widely weaponized.

An unauthenticated attacker sends a crafted request to the plugin's subscription endpoint (na=sa), placing a malicious script payload in the np1 custom field and embedding the {profile_1} placeholder inside the email local part to bypass is_email() validation, which permits curly braces there. The payload is stored and later rendered without proper escaping, so when a site administrator or visitor views the affected page the script executes in their browser - enabling session hijacking, admin-action forgery, or redirection. No public proof-of-concept exploit is referenced in the provided data, though Wordfence documents the exact bypass technique.