{"id":"CVE-2026-111830","kind":"vulnerability","aliases":["CVE-2026-111830"],"related":[],"title":"WP Mailster: stored XSS through 1.9.1.0 lets injected scripts run","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.","summary":"WP Mailster, a WordPress newsletter plugin, does not neutralize input on some pages, so stored cross-site scripting is possible. An attacker who can store content in the plugin can run scripts in the browser of a logged-in user who views it.","severity":"high","cvss":7.1,"epss":0.00146,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-mailster"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP Mailster plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-mailster --field=version`\n- Compare the result against 1.9.1.0; versions up to and including 1.9.1.0 are listed as affected","fix":"- Update WP Mailster to a version later than `1.9.1.0` once the vendor publishes a fixed release; the sources do not name the fixed version\n- Until then, restrict which roles can add subscribers or edit campaign content","status":"open","published_at":"2026-10-22T09:17:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:31:41+00:00","updated_at":"2026-10-25T03:31:41+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:31:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Mailster to a version later than `1.9.1.0` once the vendor publishes a fixed release; the sources do not name the fixed version\n- Until then, restrict which roles can add subscribers or edit campaign content","reach":"internet","title":"WP Mailster: stored XSS through 1.9.1.0 lets injected scripts run","impact":"medium","summary":"WP Mailster, a WordPress newsletter plugin, does not neutralize input on some pages, so stored cross-site scripting is possible. An attacker who can store content in the plugin can run scripts in the browser of a logged-in user who views it.","category":"package","nicknames":[],"who_cares":["wordpress","wp-mailster","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Scripts run in logged-in users' browsers, possibly stealing admin sessions","analyst_note":"Check the NVD entry for the affected input fields, the minimum role needed to store the payload, and the fixed version.","how_to_check":"- Check the installed WP Mailster plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-mailster --field=version`\n- Compare the result against 1.9.1.0; versions up to and including 1.9.1.0 are listed as affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WordPress sites running WP Mailster at version 1.9.1.0 or earlier are exposed. The risk depends on whether untrusted users can submit content that the plugin later renders to an administrator. Sites that do not run the plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000638,"input_tokens":3355,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111830':13A,16A '-2026':12A,15A '1.9.1.0':6A,100C 'affect':94C 'allow':90C 'attack':47B 'browser':60B 'content':51B 'cross':41B,78C 'cross-sit':40B,77C 'cve':11A,14A 'generat':76C 'host':20B 'improp':69C 'inject':8A 'input':34B,72C 'issu':93C 'let':7A 'log':64B 'logged-in':63B 'mailster':2A,24B,26B,84C,86C,89C,96C 'n/a':98C 'neutral':33B,70C 'newslett':29B 'packag':17B 'page':37B,75C 'plugin':30B,54B 'possibl':45B 'run':10A,56B 'script':9A,43B,57B,80C 'self':19B 'self-host':18B 'site':42B,79C 'store':3A,39B,50B,91C 'user':66B 'view':68B 'vulner':81C 'web':74C 'wordpress':21B,28B 'wp':1A,23B,25B,83C,85C,88C,95C 'wp-mailster':22B,87C 'xss':4A 'xss.this':92C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running WP Mailster at version 1.9.1.0 or earlier are exposed. The risk depends on whether untrusted users can submit content that the plugin later renders to an administrator. Sites that do not run the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111830","severity":null,"published_at":"2026-10-22T09:17:13+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111830","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111830","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}