The contrid Newsletters plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in its newsletters_video shortcode. This occurs because user input is not properly sanitized or escaped before being included in web pages. Attackers with contributor-level privileges or above can exploit this to inject arbitrary JavaScript, which executes in the context of users viewing the compromised content. This vulnerability affects all plugin versions up to and including 4.9.9.4. The CVSS 3.1 base score is 6.4 (medium), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impact on confidentiality and integrity but not availability. No patch or official fix has been documented yet.

Successful exploitation allows authenticated users with contributor or higher privileges to inject and store malicious scripts that execute in the browsers of users who view the affected pages. This can lead to unauthorized actions performed on behalf of those users, data disclosure, or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. Since the attacker must have contributor-level access, the risk is mitigated somewhat by the need for authentication and privilege.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only. Consider removing or disabling the newsletters_video shortcode if feasible. Monitor plugin updates from contrid for an official fix. Avoid granting contributor or higher privileges to untrusted users to reduce risk.