Cpe:2.3:a:newsman:newsmanapp:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3anewsmannewsmanappwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 13:18:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNewsmanApp: Stored Cross-Site Scripting via input parameters (CVE-2026-115821)https://feed.craftedsignal.io/briefs/2026-10-newsmanapp-xss/Thu, 29 Oct 2026 13:18:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-newsmanapp-xss/The NewsmanApp WordPress plugin contains a stored Cross-Site Scripting vulnerability in billing parameters that allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.The NewsmanApp plugin for WordPress (versions up to and including 3.7.29) is vulnerable to stored Cross-Site Scripting (XSS). An unauthenticated attacker can exploit this via the 'billing_first_name' and 'billing_last_name' parameters. Successful exploitation requires the Newsman Remarketing feature to be enabled and a non-empty Remarketing ID to be configured. The vulnerability stems from insufficient input sanitization and output escaping.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of an affected user's browser, potentially leading to session hijacking, unauthorized actions, or information theft when an administrator or user views the compromised page.

Recommendation

  • Update the NewsmanApp plugin for WordPress to a version patched beyond 3.7.29.
  • Disable the Newsman Remarketing feature as an interim mitigation if updating is not immediately possible.
  • Audit WordPress web server access logs for anomalous POST requests directed at the plugin functionality, specifically those containing HTML or script tags within billing fields.
]]>highadvisoryxsswordpressplugin