CVE-2026-12939

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the post_thumbnail (and newsletters_post_thumbnail) shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the post_thumbnail() method in helpers/shortcode.php, which concatenates the user-controlled $link shortcode attribute directly into an href attribute without esc_url() or esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/helpers/shortcode.php#L327
• https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/helpers/shortcode.php#L337
• https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/helpers/shortcode.php#L782
• https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.15/includes/checkinit.php#L182
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3621582%40newsletters-lite&new=3621582%40newsletters-lite
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2ca8ab94-45b8-4705-b23b-dbc743572121?source=cve

Published

Jul 29, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1293The Yoast SEO – Advanced SEO with real-time guidance and bui…6.4
• CVE-2026-12932A memory leak in the tls-crypt-v2 client key extraction in O…8.1
• CVE-2026-12935The TL-WR940N v6 router contains a vulnerability in its RTSP…8.7
• CVE-2026-12936The Recurio – Ultimate Subscription for WooCommerce plugin f…4.9
• CVE-2026-12937The Tourfic – AI Powered Travel Booking, Hotel Booking & Car…7.5
• CVE-2026-12938The Newsletters Lite plugin for WordPress is vulnerable to S…6.4
• CVE-2026-1294The All In One Image Viewer Block plugin for WordPress is vu…7.2
• CVE-2026-12940IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to una…9.8
• CVE-2026-12941The MultiVendorX – WooCommerce Multivendor Marketplace AI Po…6.5
• CVE-2026-12942IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote a…7.5
• CVE-2026-12943IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1…9.8
• CVE-2026-12945IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated u…7.1