CVE-2026-111830
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WP Mailster plugin contains a Stored Cross-Site Scripting vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.9.1.0.
Risk Assessment
An attacker can store a malicious script that executes in the browser of users viewing affected pages, potentially leading to session or data theft. The risk applies to sites with the vulnerable plugin version installed.
Recommendation
Update the WP Mailster plugin to a version later than 1.9.1.0. Until updated, consider restricting access to plugin features and monitoring for suspicious content.
Other vulnerabilities in WP Mailster
See all- CVE-2026-111829Medium
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.
- CVE-2026-105061High
Unauthenticated Cross Site Scripting (XSS) vulnerability in WP Mailster up to version 1.9.0.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
- CVE-2026-105055Medium
Missing authorization in WP Mailster plugin up to version 1.9.0.0. Allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS