CVE-2026-12938

Name of the Vulnerable Software and Affected Versions Newsletters Lite versions prior to 4.16

Description Stored Cross-Site Scripting occurs when authenticated attackers with Contributor-level access or higher inject arbitrary web scripts into pages. The issue stems from insufficient input sanitization and output escaping within the posts single() function, which allows an attacker-controlled target attribute to propagate into the global $wpml target variable. Subsequently, the shortcode posts() post thumbnail handler concatenates $wpml target into a target="..." HTML attribute without using esc attr(), leading to script execution when a user visits the affected page. This affects the target attribute of the [newsletters post] shortcode.

Recommendations Update to a version newer than 4.15. As a temporary workaround, restrict the use of the target attribute within the [newsletters post] shortcode.