CVE-2022-1889

Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting

State: Published
Severity: Not scored
Published: Jun 20, 2022
Updated: Aug 3, 2024
Reserved: May 25, 2022

Description

The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed

Scores

The record has no CVSS score.

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
Newsletter – Send awesome emails from WordPressUnknown	7.4.6 to before 7.4.6Affected

References

https://wpscan.com/vulnerability/ee3832e2-ce40-4063-a23e-44c7f7f5f46a

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.