CVE-2023-27922: Thenewsletterplugin Newsletter

Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days.

Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary script.

Affected products

• Thenewsletterplugin Newsletter: before 7.6.9 (fixed in 7.6.9)

Published 2023-05-23. Last modified 2026-06-17.