CVE-2026-12939: Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
Vulnerability summary
CVE-2026-12939 is a medium (CVSS 6.4) Cross-site Scripting vulnerability in contrid newsletters. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.3% of scored vulnerabilities. Fixed in 4.16.
Timeline
- 29-07-2026PublishedVulnerability first disclosed.
- 29-07-2026Last modifiedVulnerability information updated.
Description
The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the post_thumbnail (and newsletters_post_thumbnail) shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the post_thumbnail() method in helpers/shortcode.php, which concatenates the user-controlled $link shortcode attribute directly into an href attribute without esc_url() or esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST6.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- wordfenceSource6.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.35% on 24-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Contrid1 product
- newsletters≤ 4.15
Wordpress1 product
- newsletters-lite≤ 4.15 (fixed in 4.16)
2 vendors · 2 products