CVE-2026-90981: WordPress Newsletter Plugin XSS Vulnerability

CVE-2026-90981 Overview

CVE-2026-90981 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Newsletter – Send awesome emails from WordPress plugin. The flaw affects all versions up to and including 9.3.8. Unauthenticated attackers can inject arbitrary web scripts through the nn parameter due to insufficient input sanitization and output escaping. Exploitation requires the victim to be a logged-in administrator, because the antibot check auto-passes for authenticated users and routes the unsanitized payload through the administrator-visible output branch of dienow(). The vulnerability is tracked under CWE-79.

Critical Impact
A successful attack executes arbitrary JavaScript in an administrator's browser session, enabling session hijacking, privileged action abuse, or persistent backdoor installation via plugin/theme edits.

Affected Products

Newsletter – Send awesome emails from WordPress plugin (all versions ≤ 9.3.8)
WordPress sites with the Newsletter plugin active
Administrator accounts on affected WordPress installations

Discovery Timeline

2026-09-18 - CVE-2026-90981 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90981

Vulnerability Analysis

The Newsletter plugin exposes front-end endpoints that accept the nn request parameter and reflect its value back to the user through the plugin's dienow() error/output routine. Because the value is not sanitized or escaped, an attacker can supply HTML and JavaScript that renders in the response.

The attack requires user interaction (UI:R) and crosses a security boundary (S:C), because the reflected script executes in the WordPress administrator context when the admin clicks a crafted link. This aligns with the CWE-79 class of improper neutralization of input during web page generation.

An EPSS probability of 0.38% indicates low near-term exploitation likelihood, but WordPress plugins with wide install bases are routinely targeted by opportunistic scanners.

Root Cause

The root cause is missing input validation and output encoding on the nn parameter along the antispam/subscription code path. Relevant plugin source files include antispam.php, module-base.php, plugin.php, and subscription.php. A design flaw compounds the issue: the antibot check auto-passes for authenticated users, so administrator sessions receive the unsanitized payload through dienow() rather than being blocked.

Attack Vector

The attack vector is network-based and requires no authentication from the attacker. The attacker crafts a URL to the target WordPress site containing a malicious payload in the nn query parameter. The attacker then delivers this URL to a WordPress administrator through phishing, social media, or a compromised web page. When the logged-in administrator clicks the link, the browser sends the request, the plugin reflects the payload into the response, and the script executes with the administrator's session privileges.

Because WordPress administrators can install plugins, edit themes, and create users, script execution in that context typically leads to full site compromise. See the Wordfence advisory for additional exploitation context.

Detection Methods for CVE-2026-90981

Indicators of Compromise

HTTP requests to Newsletter plugin endpoints containing nn parameter values with HTML tags, <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers on administrator sessions pointing to external phishing infrastructure immediately preceding requests to the plugin.
Unexpected administrator activity following a click-through, including new user creation, plugin/theme file modifications, or outbound requests to attacker-controlled domains.

Detection Strategies

Inspect web server access logs for requests to Newsletter plugin routes where the nn parameter contains script-like syntax or encoded HTML metacharacters.
Deploy a Web Application Firewall (WAF) rule to flag reflected XSS patterns in query strings targeting /wp-content/plugins/newsletter/ paths.
Correlate administrator login sessions with subsequent anomalous privileged actions to detect post-exploitation activity.

Monitoring Recommendations

Monitor WordPress wp_users and wp_usermeta tables for unauthorized administrator additions or role changes.
Enable file integrity monitoring on wp-content/plugins/ and wp-content/themes/ to detect unauthorized file edits following a suspected click-through.
Aggregate WordPress access logs into a centralized SIEM or data lake and alert on query strings matching XSS signatures against the Newsletter plugin.

How to Mitigate CVE-2026-90981

Immediate Actions Required

Update the Newsletter plugin to the version released after 9.3.8 that contains the fix referenced in the WordPress plugin changeset 3695457.
Instruct WordPress administrators to avoid clicking untrusted links and to use a dedicated browser profile for admin activity.
Review recent administrator activity, new users, and modified plugin/theme files for signs of prior exploitation.

Patch Information

The vendor addressed the vulnerability in the version following 9.3.8. Details of the source fix are documented in the Newsletter plugin changeset and the Wordfence vulnerability report. Apply the update through the WordPress plugin management console or via WP-CLI.

Workarounds

Deploy a WAF rule that blocks requests to the plugin containing HTML or script tokens in the nn parameter.
Restrict WordPress /wp-admin access to trusted source IP addresses to reduce exposure of authenticated admin sessions.
Enforce Content Security Policy (CSP) headers on the WordPress site to limit inline script execution.
Disable or deactivate the Newsletter plugin until the patched version can be deployed.

bash

# Update the Newsletter plugin using WP-CLI
wp plugin update newsletter --path=/var/www/html

# Verify the installed version is above 9.3.8
wp plugin get newsletter --field=version --path=/var/www/html

# Temporary workaround: deactivate the plugin until patched
wp plugin deactivate newsletter --path=/var/www/html