CVE-2026-90981 Details

A reflected cross-site scripting vulnerability has been identified in the WordPress Newsletter plugin, specifically in versions up to and including 9.3.8. The issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts via the 'nn' parameter. These scripts could be executed if the attacker successfully convinces a user, particularly a logged-in administrator, to click a link containing the injected script. This exploitation is facilitated by the plugin's antibot check, which automatically clears for authenticated users, directing the unsanitized script through an output channel visible to administrators.