CVE-2026-81290
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters versions up to 5.9.33.
Risk Assessment
An attacker can inject malicious script, potentially leading to data theft or session hijacking.
Recommendation
Update the Email Subscribers & Newsletters plugin to the latest patched version.
Other vulnerabilities in Email Subscribers & Newsletters
See all- CVE-2026-12757Medium
The Email Subscribers & Newsletters plugin for WordPress up to version 5.9.27 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes.
- CVE-2026-11592Medium
The Email Subscribers & Newsletters plugin for WordPress up to version 5.9.27 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access or higher can overwrite mail settings, create audience lists, insert contacts, create and overwrite newsletters, add workflows, and send mass emails to arbitrary recipients.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.