CVE-2024-47346

Vulnerability

Overview The Newsletters plugin for WordPress (newsletters-lite) suffers from a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation [1]. This affects all versions up to and including 4.9.9.1.

Exploitation

Details An attacker can exploit this flaw by crafting a malicious URL that, when visited by a privileged user (such as an administrator), injects arbitrary JavaScript into the page [1]. The attack requires user interaction—the victim must click the link or submit a crafted form—but no prior authentication is needed for the attacker to deliver the payload.

Impact

Successful exploitation allows the attacker to execute malicious scripts in the context of the victim's browser session. This can lead to actions such as redirecting visitors to malicious sites, displaying unauthorized advertisements, or stealing sensitive information like session cookies [1]. The vulnerability is considered moderately dangerous and is expected to be used in mass-exploit campaigns targeting thousands of WordPress sites.

Mitigation

The vendor has released version 4.9.9.2 which resolves the issue. Users are strongly advised to update immediately. For those unable to update, Patchstack offers a mitigation rule to block attacks until the patch is applied [1].