Stored Cross-Site Scripting vulnerability in Newsletter plugin for WordPress

CVE-2023-4772

What is CVE-2023-4772?

The Newsletter plugin for WordPress, versions up to and including 7.8.9, is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on attributes provided by users. This vulnerability enables authenticated attackers with at least contributor-level permissions to insert malicious web scripts, which can execute whenever a user visits the compromised pages. This presents a significant risk, as it can lead to unauthorized access and data compromise, impacting user trust.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References