Live › vulnerability › CVE-2026-115821
The NewsmanApp plugin for WordPress does not sanitize the billing first and last name parameters, so unauthenticated attackers can store script that runs in pages. The script runs in the browser of any user who opens an affected page, including site visitors and administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 12:24 UTC. All times on this page are UTC.
Only WordPress sites running the NewsmanApp plugin version 3.7.29 or earlier, with the Newsman Remarketing feature enabled and a non-empty Remarketing ID configured. Sites without the plugin, or with remarketing disabled, are not exposed according to the description.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| newsmanapp | wordpress | <= 3.7.29 | 3.7.32 |
3.7.29 or lower in the WordPress plugins screen.Update the NewsmanApp plugin to 3.7.32 or later (vendor changelog on wordpress.org names CVE-2026-115821; remarketing purchase script values are now JSON encoded).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is configured in the plugin settings.
This page as .md · .json · in your agent: get_signal("CVE-2026-115821")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.