NewsmanApp: Stored Cross-Site Scripting via input parameters (CVE-2026-115821)

The NewsmanApp plugin for WordPress (versions up to and including 3.7.29) is vulnerable to stored Cross-Site Scripting (XSS). An unauthenticated attacker can exploit this via the 'billing_first_name' and 'billing_last_name' parameters. Successful exploitation requires the Newsman Remarketing feature to be enabled and a non-empty Remarketing ID to be configured. The vulnerability stems from insufficient input sanitization and output escaping.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of an affected user's browser, potentially leading to session hijacking, unauthorized actions, or information theft when an administrator or user views the compromised page.

Recommendation

• Update the NewsmanApp plugin for WordPress to a version patched beyond 3.7.29.
• Disable the Newsman Remarketing feature as an interim mitigation if updating is not immediately possible.
• Audit WordPress web server access logs for anomalous POST requests directed at the plugin functionality, specifically those containing HTML or script tags within billing fields.