WP Mailster <= 1.9.0.0 - Unauthenticated Stored Cross-Site Scripting via Subscriber Name
- ID
- WPSEC-2026-0420
- Plugin
- WP Mailster (wp-mailster)
- Affected
- all versions before 1.9.1.0
- Remediation
- Update to 1.9.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- WP Mailster on WPSec AttackSurface
- Fix released
- Published
Description
The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subscriber name in all versions up to, and including, 1.9.0.0 due to insufficient output escaping of recipient names placed in an HTML attribute of the mailing list recipient listing in the admin area. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through a subscription form when the mailing list accepts subscriptions from visitors who are not logged in (otherwise authenticated attackers with Subscriber-level access and above), which will execute whenever a user views the list's recipients in the admin area.
References
- https://wpsec.com/vuln/WPSEC-2026-0420/
- https://plugins.svn.wordpress.org/wp-mailster/tags/1.9.1.0/
- https://wordpress.org/plugins/wp-mailster/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS