Live › vulnerability › CVE-2026-111830
Go to dashboardWP Mailster, a WordPress newsletter plugin, does not neutralize input on some pages, so stored cross-site scripting is possible. An attacker who can store content in the plugin can run scripts in the browser of a logged-in user who views it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites running WP Mailster at version 1.9.1.0 or earlier are exposed. The risk depends on whether untrusted users can submit content that the plugin later renders to an administrator. Sites that do not run the plugin can skip it.
No product ranges from the sources yet.
wp plugin get wp-mailster --field=version1.9.1.0 once the vendor publishes a fixed release; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-111830")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.