Newsletter Send Awesome Emails From Wordpress
Monthly
Unauthenticated stored cross-site scripting in the Newsletter plugin for WordPress through 9.4.0 allows remote attackers to inject JavaScript that executes when a victim renders the stored content. Attackers can reach the public subscription endpoint (na=sa) without a nonce, capability check, or CAPTCHA, place the payload in the 'np1' custom field, and bypass email-address validation by embedding the '{profile_1}' placeholder in the local part of the submitted address. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and this is a credible, moderately-high priority issue rather than an inflated high-CVSS score.
Unauthenticated attackers who obtain a valid signed click-tracking URL from the Newsletter - Send awesome emails from WordPress plugin (all versions up to and including 9.3.9) can receive a subscriber's permanent raw authentication token in a Set-Cookie response header and use it to export that subscriber's full PII record, rewrite their stored profile, or silently unsubscribe them. Exploitation requires possession of one leaked signed link - such links are embedded in every external link of every newsletter, carry no timestamp, and never expire until the site's relink key rotates - but no nonce, password, authentication, or email challenge is needed once the URL is observed. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, with confidentiality and integrity impact of Low per independent assessment); no CISA KEV listing and no public exploit code identified at time of analysis, making this a bounded data-privacy and account-manipulation issue rather than a server-compromise emergency.
Reflected cross-site scripting in The Newsletter - Send awesome emails from WordPress plugin (satollo) versions up to and including 9.3.8 lets an unauthenticated attacker deliver a crafted link containing a malicious 'nn' parameter that executes script in the browser of a logged-in WordPress administrator who clicks it. The payload only survives to the reflected output branch of the plugin's dienow() function for authenticated users, because the built-in antibot/antispam check auto-passes logged-in accounts and returns the unsanitized value in administrator-visible output; anonymous or non-admin visitors do not trigger the sink. Impact is limited to session/token theft or admin-performed actions in the WordPress context of the victim (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), making it a genuine but contained issue that requires a specific social-engineering step against an administrator.
Unauthenticated stored cross-site scripting in the Newsletter plugin for WordPress through 9.4.0 allows remote attackers to inject JavaScript that executes when a victim renders the stored content. Attackers can reach the public subscription endpoint (na=sa) without a nonce, capability check, or CAPTCHA, place the payload in the 'np1' custom field, and bypass email-address validation by embedding the '{profile_1}' placeholder in the local part of the submitted address. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and this is a credible, moderately-high priority issue rather than an inflated high-CVSS score.
Unauthenticated attackers who obtain a valid signed click-tracking URL from the Newsletter - Send awesome emails from WordPress plugin (all versions up to and including 9.3.9) can receive a subscriber's permanent raw authentication token in a Set-Cookie response header and use it to export that subscriber's full PII record, rewrite their stored profile, or silently unsubscribe them. Exploitation requires possession of one leaked signed link - such links are embedded in every external link of every newsletter, carry no timestamp, and never expire until the site's relink key rotates - but no nonce, password, authentication, or email challenge is needed once the URL is observed. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, with confidentiality and integrity impact of Low per independent assessment); no CISA KEV listing and no public exploit code identified at time of analysis, making this a bounded data-privacy and account-manipulation issue rather than a server-compromise emergency.
Reflected cross-site scripting in The Newsletter - Send awesome emails from WordPress plugin (satollo) versions up to and including 9.3.8 lets an unauthenticated attacker deliver a crafted link containing a malicious 'nn' parameter that executes script in the browser of a logged-in WordPress administrator who clicks it. The payload only survives to the reflected output branch of the plugin's dienow() function for authenticated users, because the built-in antibot/antispam check auto-passes logged-in accounts and returns the unsanitized value in administrator-visible output; anonymous or non-admin visitors do not trigger the sink. Impact is limited to session/token theft or admin-performed actions in the WordPress context of the victim (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), making it a genuine but contained issue that requires a specific social-engineering step against an administrator.