CVE-2026-12939

Name of the Vulnerable Software and Affected Versions Newsletters Lite versions prior to 4.16

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the post thumbnail() method within helpers/shortcode.php. The software directly concatenates the user-controlled link attribute of the post thumbnail and newsletters post thumbnail shortcodes into an href attribute without using esc url() or esc attr(). This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version newer than 4.15. As a temporary workaround, restrict the use of the link attribute in post thumbnail and newsletters post thumbnail shortcodes for users with contributor-level access.