---
id: "CVE-2026-115821"
kind: "vulnerability"
aliases: ["CVE-2026-115821"]
title: "NewsmanApp WordPress plugin: stored XSS via billing name fields"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "newsmanapp", "fixed": ["3.7.32"], "affected": "<= 3.7.29", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["ecommerce", "newsmanapp", "package", "wordpress"]
not_affected_if: ["plugin-newer-than-3.7.29", "plugin-not-installed", "remarketing-disabled"]
published_at: "2026-10-29T12:17:11+00:00"
first_seen_at: "2026-10-29T12:24:38+00:00"
updated_at: "2026-10-29T12:26:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115821", "first_seen_at": "2026-10-29T12:24:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T12:26:37+00:00"}]
---

# NewsmanApp WordPress plugin: stored XSS via billing name fields

The NewsmanApp plugin for WordPress does not sanitize the billing first and last name parameters, so unauthenticated attackers can store script that runs in pages. The script runs in the browser of any user who opens an affected page, including site visitors and administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:newsmanapp affected <= 3.7.29 fixed 3.7.32

## How to check

- Check whether the NewsmanApp plugin is installed and its version is `3.7.29` or lower in the WordPress plugins screen.
- Check whether the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is set in the plugin settings.

## Fix

Update the NewsmanApp plugin to 3.7.32 or later (vendor changelog on wordpress.org names CVE-2026-115821; remarketing purchase script values are now JSON encoded).

## Timeline

- 2026-10-29T12:24:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115821
- 2026-10-29T12:26:37+00:00 analyst — Vendor changelog on wordpress.org plugin page lists the fix in 3.7.32 (3.7.30/3.7.31 changelog not confirmed to contain it). Not exploited per sources; Patchstack lists same range. Only how-to-check not verified (settings names from NVD).

## Documents

- [fix] NewsmanApp plugin changelog (wordpress.org) https://wordpress.org/plugins/newsmanapp/
- [mentions] Patchstack: NewsmanApp <= 3.7.29 XSS https://patchstack.com/database/wordpress/plugin/newsmanapp/vulnerability/wordpress-newsmanapp-plugin-3-7-29-unauthenticated-stored-cross-site-scripting-vulnerability

## From the sources

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is configured in the plugin settings.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_