CVE-2026-66596
Received Received - Intake

Unauthenticated XSS in Newsletter Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Patchstack

Description
Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-66596
EUVD
EUVD-2026-62374

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
newsletter newsletter to 9.3.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Unauthenticated Cross Site Scripting (XSS) vulnerability in the Newsletter plugin for WordPress versions 9.3.3 and earlier. It allows attackers to inject malicious scripts into websites that execute when visitors access the site. The exploit requires user interaction, such as clicking a malicious link, and can be performed by unauthenticated users.

Detection Guidance

Detecting this XSS vulnerability typically involves checking for outdated versions of the Newsletter plugin. Inspect your WordPress installation for the plugin version in the admin panel or via file system checks. No specific commands are provided in the resources, but monitoring for unusual script injections in web pages or reviewing server logs for suspicious activity may help.

Impact Analysis

This vulnerability can lead to actions like website redirects, display of unwanted content, or theft of user data. Attackers could exploit it to perform actions on behalf of users or spread malware. The risk is higher for websites with many visitors as it can be targeted in mass-exploit campaigns affecting thousands of sites.

Mitigation Strategies

Immediately update the Newsletter plugin to version 9.3.4 or later. If updating is not possible, use mitigation tools like Patchstack to block attacks until the update is applied. Remove or disable the plugin if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66596. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart