Description

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-31T21:17:49.930Z",
  "pubdate": "2026-08-31T21:17:49.930Z",
  "executiveSummary": "A significant security vulnerability has been identified within the 'Email Subscribers & Newsletters' WordPress plugin, specifically affecting all versions up to and including 5.9.33. This security flaw is categorized as an Unauthenticated Cross-Site Scripting (XSS) vulnerability, representing a severe threat to affected WordPress installations. Because the vulnerability does not require any prior authentication or user privileges to exploit, any remote threat actor can leverage it to target vulnerable websites. The primary impact of this vulnerability involves the unauthorized execution of arbitrary JavaScript code within the context of a victim's browser session.\nThe risk implications for organizations running the affected plugin versions are substantial. If an attacker successfully exploits this flaw, they can target high-privileged users, such as site administrators. Once an administrative user triggers the payload, the injected script runs with the administrator's elevated privileges. This capability allows attackers to perform unauthorized actions, such as creating new administrative accounts, altering website configuration settings, stealing sensitive session cookies, or redirecting visitors to external malicious domains. Consequently, the confidentiality, integrity, and availability of the host platform are severely compromised, necessitating immediate defensive action and remediation.",
  "technicalDetails": "The root cause of this vulnerability lies in the inadequate validation, sanitization, and output escaping of user-supplied input within the public-facing subscription mechanisms of the 'Email Subscribers & Newsletters' plugin. In versions 5.9.33 and below, the application accepts inputs such as names, email addresses, and subscriber group identifiers through front-end forms without validating that the input conforms to expected formats or stripping out potentially malicious HTML or JavaScript tags.\nAn unauthenticated attacker can exploit this lack of sanitization by crafting a malicious payload—typically containing script tags or event handlers—and submitting it through the standard subscription form or directly via an HTTP POST request to the processing endpoint. Because there are no access controls or authentication checks protecting this submission flow, the application processes the request and persists the malicious payload into the underlying WordPress database as part of the subscriber record.\nThe attack lifecycle proceeds as a Stored Cross-Site Scripting attack. The stored payload remains latent in the database until an authorized administrator logs into the WordPress backend and navigates to the administrative interface designed to manage, view, or export subscribers. When the administrative panel renders the list of subscribers, the application retrieves the malicious record from the database and outputs it directly into the HTML Document Object Model (DOM) without proper context-aware escaping (such as utilizing functions like esc_html() or esc_attr()).\nConsequently, the administrator's web browser interprets the injected data as executable code rather than plain text. The script executes within the security context of the active administrative session. This execution bypasses the Same-Origin Policy (SOP), granting the script full access to the administrator's session cookies (unless protected by the HttpOnly flag), DOM structure, and security tokens (nonces). The script can silently perform background HTTP requests to create a new administrator account, inject malicious backdoors into the theme files, or exfiltrate sensitive site data to an attacker-controlled server, completely compromising the application server."
}