The Newsletters Lite WordPress plugin allows stored Cross‑Site Scripting through the 'target' attribute of the [newsletters_post] shortcode. Because the plugin fails to escape the attribute value, an authenticated user with Contributor or higher privileges can inject malicious JavaScript that is stored and later executed whenever anyone views a page containing the shortcode. The injected script runs in the victim’s browser and can lead to session hijacking, defacement, or credential theft.

This flaw affects all installations of the Newsletters Lite plugin for WordPress versions 4.15 and earlier. The vendor is contrid and the product is "Newsletters Lite". Sites running any of these releases are vulnerable.

The vulnerability has a CVSS score of 6.4, indicating a medium severity, and an EPSS score of less than 1%, suggesting a low current exploitation probability. It is not listed in the CISA KEV catalog. The attack requires authenticated access at the Contributor level, so only users with that role can inject the payload. Once injected, the stored XSS can affect any site visitor, potentially causing serious information disclosure or credential compromise. Administrators should consider the moderate risk and assess whether their user roles permit such access.