CVE-2026-115821

Name of the Vulnerable Software and Affected Versions NewsmanApp versions prior to 3.7.30

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue is exploitable when the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is configured in the settings. The vulnerable parameters are billing first name and billing last name.

Recommendations Update NewsmanApp to version 3.7.30 or later. Disable the Newsman Remarketing feature or clear the Remarketing ID configuration to mitigate the risk.