CVE-2022-1756 json
Newsletter < 7.4.5 - Reflected Cross-Site Scripting
published 2022-06-13 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-25037
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
Patch / fix
- thenewsletterplugin newsletter 7.4.5
Exploit prediction
1.94% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Newsletter < 7.4.5 - Cross-Site Scripting nuclei detection template
- wpscan.com https://wpscan.com/vulnerability/6ad407fe-db2b-41fb-834b-dd8c4f62b072 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- Unknown Newsletter – Send awesome emails from WordPress
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Technology feeds
References
-
wpscan.com
/vulnerability/6ad407fe-db2b-41fb-834b-dd8c4f62b072
exploit, third-party-advisory
Sources
- CVE List CVE-2022-1756
- NVD CVE-2022-1756
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.