Newsletters Lite <= 4.15 Authenticated Stored XSS Vulnerability (CVE-2026-12939) Advisory

Vulnerability Overview Vulnerability Name: Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute CVE ID: CVE-2026-12939 CVSS Score: 6.4 (Medium) Published Date: July 28, 2026 Last Updated Date: July 29, 2026 Researchers: Wordfence PRISM - Wordfence Affected Versions Software Type: Plugin Software Name: newsletters-lite Affected Versions: <= 4.15 Fixed Version: 4.16 Remediation Remediation Method: Upgrade to version 4.16 or later. Vulnerability Description This vulnerability exists in the Newsletters Lite plugin, allowing authenticated attackers (at the Contributor+ level) to inject arbitrary web scripts via the 'target' attribute. Specifically, the plugin fails to adequately sanitize input and escape output when handling the 'target' attribute, enabling attackers to craft malicious 'target' attributes that execute arbitrary web scripts on the page. References plugins.trac.wordpress.org Additional Information API Usage: The Wordfence Intelligence Vulnerability Database API is completely free and can be used for personal and commercial purposes. Support: 24/7 support is available with a 1-hour response time. Recent Vulnerabilities List of Recent Vulnerabilities: The page lists several recent vulnerabilities for the Newsletters plugin, including unauthorized stored cross-site scripting and unauthorized PHP object injection. Copyright Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Contact Contact Email: wf-support@wordfence.com Other Disclaimer: Page content is copyrighted and may not be copied, distributed, or modified without permission. Summary This is a stored cross-site scripting vulnerability affecting the Newsletters Lite plugin versions <= 4.15. Users are advised to upgrade to version 4.16 or later as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Newsletters Lite <= 4.15 Authenticated Stored XSS Vulnerability (CVE-2026-12939) Advisory

More from this source