CVE-2022-1889: Thenewsletterplugin Newsletter

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed

Affected products

• Thenewsletterplugin Newsletter: before 7.4.6 (fixed in 7.4.6)

Published 2022-06-20. Last modified 2026-06-17.