CVE-2026-96566

Published 2 October 2026 · tracked since 2 October 2026

Description

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-104606 MEDIUM 6.3
• CVE-2026-94541 CRITICAL 9.8
• CVE-2026-87920 HIGH 7.2
• CVE-2026-103552 HIGH 7.3
• CVE-2026-97663 HIGH 7.2
• CVE-2026-97338 MEDIUM 6.4
• CVE-2026-97342 HIGH 7.2
• CVE-2026-97634 MEDIUM 6.5
• CVE-2026-97637 CRITICAL 9.8
• CVE-2026-97641 HIGH 7.2

→ Open the live CVE board · all tools