Stored Cross-Site Scripting Vulnerability in NewsmanApp for WordPress
CVE-2026-115821

7.2HIGH

Key Information:

Vendor

WordPress
Status
Newsmanapp
Vendor
CVE Published:
29 October 2026

What is CVE-2026-115821?

The NewsmanApp plugin for WordPress is affected by a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping within the 'billing_first_name' and 'billing_last_name' parameters. This issue exists in all versions up to and including 3.7.29, and can be exploited by unauthenticated attackers when the Remarketing feature is enabled. If a Remarketing ID is set, attackers can inject arbitrary scripts into web pages, potentially compromising user data and site integrity. It is critical for users to review their plugin configurations and apply necessary updates to mitigate this risk.

Affected Version(s)

NewsmanApp 0 <= 3.7.29

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/newsmanapp/tag...
https://plugins.trac.wordpress.org/browser/newsmanapp/tag...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

poiri3r
.