WordPress Knews Multilingual Newsletters Cross-Site Scripting Scanner

WordPress Knews Multilingual Newsletters is a plugin that enables website administrators to create, manage, and send newsletters in multiple languages. It is commonly used by businesses, media outlets, and bloggers with a global audience to maintain user engagement through email marketing. The plugin offers customizable templates and integrates seamlessly with WordPress, allowing operators to send updates directly to subscribers. Its multi-language support is particularly valuable for websites catering to diverse linguistic groups, enhancing communication and outreach efforts.

The Cross-Site Scripting (XSS) vulnerability in this plugin arises from insufficient input sanitization and output escaping. When user-supplied data is processed without proper validation, an attacker can inject malicious JavaScript code that executes in the context of other users' browsers. This vulnerability is classified as stored XSS, as the injected script persists on the server and affects all visitors to the compromised page.

Specifically, the vulnerability exists in the newsletter subscription form handling. The 'email' parameter is not properly sanitized before being stored and later displayed in the admin dashboard or subscriber-facing pages. An attacker can submit a crafted payload containing JavaScript code through this parameter, which then executes when an administrator views the subscriber list or when the newsletter is rendered.

If exploited, an attacker can steal session cookies, redirect users to malicious sites, deface web pages, or perform actions on behalf of authenticated users. This can lead to account takeover, data theft, and reputational damage. The CVSS score of 7.2 indicates a high severity, especially since no authentication is required for exploitation, making it a critical risk for any site using this plugin version.