CVE-2022-1889 Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting

2022-06-2010:26:13

CWE-79

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

25.0%

JSON

The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed

CNA Affected

[
  {
    "product": "Newsletter – Send awesome emails from WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "7.4.6",
        "status": "affected",
        "version": "7.4.6",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/ee3832e2-ce40-4063-a23e-44c7f7f5f46a

0.001 Low

EPSS

Percentile

25.0%

JSON

Related for CVELIST:CVE-2022-1889