# MailPoet – Newsletters, Email Marketing, and Automation <= 5.40.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Newsletter Style Settings

- **ID:** WPSEC-2026-0500
- **Plugin:** MailPoet – Newsletters, Email Marketing, and Automation (`mailpoet`), https://wordpress.org/plugins/mailpoet/
- **Affected versions:** all versions before 5.41.0
- **Fixed in:** 5.41.0 (Update to 5.41.0 or later.)
- **Severity:** Medium 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mailpoet
- **Fix released:** 2026-10-06
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0500/

## Description

The MailPoet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via newsletter global style settings in all versions up to, and including, 5.40.0. This is due to style property names, values and selectors from a newsletter's saved global styles being written into the rendered newsletter's <style> element without validation, allowing a value to close the style element. This makes it possible for authenticated attackers with access to manage MailPoet emails, which by default includes Editors, to inject arbitrary web scripts that execute when a user views the rendered newsletter, such as its view-in-browser page or preview. This only affects multi-site installations and installations where unfiltered_html has been disabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-0500/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.41.0/
- https://wordpress.org/plugins/mailpoet/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0500/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.