Medium severity · published Jun 5, 2024
CVE-2024-5317
Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
Newsletter – Send awesome emails from WordPress · satollo
through 8.3.4 · source: vendor
NE
Newsletter · Thenewsletterplugin
before 8.3.5 · source: NVD
NS
Newsletter Send Awesome Emails · Newsletter
through 8.3.4 · source: CISA
Affected product
NS
Newsletter – Send awesome emails from WordPress
satollo
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5317
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5317
Patch
https://plugins.trac.wordpress.org/changeset/3095002/newsletter
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/4876e05e-efa6-46c6-832b-9ecc42934998?source=cve
More from Newsletter – Send awesome emails from WordPress
7.2
CVE-2026-96566
Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
6.1
CVE-2026-90981
Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
5.4
CVE-2023-4772
Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
5.3
CVE-2026-92537
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
4.3
CVE-2026-1051
Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription