Impact

Successful exploitation allows unauthenticated attackers to inject arbitrary web scripts into pages. This poses a high risk to WordPress installations by potentially facilitating account takeover or unauthorized actions if administrative users view the injected content. The vulnerability is widespread among sites utilizing this plugin for email management.

Recommendation

Update the "The Newsletter - Send awesome emails from WordPress" plugin to a version released after 9.4.0 that contains the input sanitization patches. Monitor web server logs for HTTP POST requests to the subscription endpoint containing suspicious characters or script tags in the email or 'np1' parameters.

Attack Chain

1. Attacker identifies a target WordPress site using the vulnerable plugin.
2. Attacker crafts a malicious payload containing JavaScript, wrapping it in an email-like structure.
3. Attacker uses the '{profile_1}' placeholder within the email field to bypass 'is_email()' validation.
4. Attacker includes the malicious script within the 'np1' custom field parameter.
5. Attacker submits a POST request to the 'na=sa' subscription endpoint.
6. The plugin improperly sanitizes the 'np1' input and stores it in the WordPress database.
7. A target user (e.g., an administrator) views the page where the stored script is rendered.
8. The malicious script executes in the victim's browser session.