Description

Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-10-06T09:17:40.597Z",
  "pubdate": "2026-10-06T09:17:40.597Z",
  "executiveSummary": "WP Mailster versions 1.9.0.0 and below are susceptible to an unauthenticated Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability allows remote, unauthenticated attackers to inject malicious JavaScript into the web application, which then executes within the context of a victim's browser session.\nThe security risk is significant as it facilitates unauthorized actions, session hijacking, and the theft of sensitive user data, including authentication cookies or administrative credentials.\nThe flaw stems from insufficient input sanitization of parameters processed by the plugin, enabling arbitrary script execution without requiring prior authentication.\nGiven that this is an unauthenticated vulnerability, it is highly accessible to malicious actors targeting WordPress environments. Exploitation is achieved by tricking a victim into visiting a specially crafted URL or navigating to an impacted page containing the payload.\nOrganizations using affected versions of WP Mailster are at risk of compromised site integrity and unauthorized data exfiltration.",
  "technicalDetails": "The vulnerability is identified as a Reflected Cross-Site Scripting (XSS) flaw located within the handling of user-supplied data in WP Mailster versions 1.9.0.0 and earlier.\nThe root cause of the vulnerability is the application's failure to properly sanitize or escape input parameters before reflecting them in the HTML response provided to the user. Because the application does not validate the input, an attacker can supply a crafted string containing malicious JavaScript tags (e.g., <script>alert(1)</script>).\nThe attack flow begins when an unauthenticated attacker identifies an injection vector within the plugin's query parameters. The attacker then crafts a URL containing the malicious script payload embedded within the vulnerable parameter. When an unsuspecting user, potentially an administrator, clicks this link, the browser executes the script in the context of the vulnerable WordPress site.\nThe scope of impact is broad, as the executed script inherits the security context of the user's session. If the victim has administrative privileges, the attacker can use the XSS payload to perform unauthorized administrative actions, such as creating new user accounts, modifying plugin settings, or injecting further malicious content into the site's database to achieve persistence.\nFurthermore, the injected script can be utilized to perform cross-site request forgery (CSRF), redirect users to malicious domains, or intercept sensitive information such as session tokens stored in document.cookie. The lack of proper content security policy (CSP) or input filtering allows the malicious payload to be rendered directly by the browser.\nThe vulnerability persists because the plugin code fails to implement adequate output encoding using standard WordPress security functions like esc_html(), esc_js(), or esc_attr() when reflecting dynamic data. Without these security controls, the application blindly trusts user input, transforming the legitimate web page into a vector for code injection."
}