MailPoet – Newsletters, Email Marketing, and Automation <= 5.40.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Newsletter Style Settings
- ID
- WPSEC-2026-0500
- Plugin
- MailPoet – Newsletters, Email Marketing, and Automation (mailpoet)
- Affected
- all versions before 5.41.0
- Remediation
- Update to 5.41.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-07
- Attack surface
- MailPoet – Newsletters, Email Marketing, and Automation on WPSec AttackSurface
- Fix released
- Published
Description
The MailPoet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via newsletter global style settings in all versions up to, and including, 5.40.0. This is due to style property names, values and selectors from a newsletter's saved global styles being written into the rendered newsletter's <style> element without validation, allowing a value to close the style element. This makes it possible for authenticated attackers with access to manage MailPoet emails, which by default includes Editors, to inject arbitrary web scripts that execute when a user views the rendered newsletter, such as its view-in-browser page or preview. This only affects multi-site installations and installations where unfiltered_html has been disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0500/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.41.0/
- https://wordpress.org/plugins/mailpoet/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS