CVE-2026-115821

HighCVSS 7.2/10Last modified Oct 29, 2026

Description

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is configured in the plugin settings.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1158227.5Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman CVE-2026-1158239.1Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a CVE-2026-1158247.5Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder CVE-2026-1158257.5HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The requ CVE-2026-1158289.4In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-c CVE-2026-1158299.9In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prio CVE-2026-115836.3A vulnerability has been found in CodeAstro Student Attendance Management System 1.0. This affects an unknown function of the file /attendan CVE-2026-1158308.7In Secret Server on-prem versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin p CVE-2026-1158314.3The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to t CVE-2026-115846.3A vulnerability was found in CodeAstro Student Attendance Management System 1.0. This impacts an unknown function of the file /attendance-ph CVE-2026-1158407.2The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplink' parameter in CVE-2026-1158456.4An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated r