The Newsletter plugin for WordPress is affected by a stored cross‑site scripting flaw that arises from inadequate sanitization of the 'np1' custom field. When an unauthenticated user submits malicious JavaScript via this parameter, the script is stored and later executed in the context of any user who views the affected page. This can enable session hijacking, defacement, or malicious redirection.

All installations of the satollo Newsletter – Send awesome emails from WordPress plugin whose version is 9.4.0 or older are impacted, regardless of site configuration or user roles.

The CVSS score of 7.2 indicates high severity, but no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Attackers can target the public subscription endpoint (parameter na=sa) because it lacks nonce verification, capability checks, or CAPTCHA. By embedding the {profile_1} placeholder inside a crafted email address, the attacker bypasses WordPress's is_email validation while still delivering the payload, allowing the script to be stored in the plugin and executed when a user accesses the infected page.