CVE-2026-105061: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Bởi brandtoss WP Mailster

This vulnerability, identified as CWE-79, involves improper neutralization of input during web page generation in WP Mailster versions up to 1.9.0.0. It enables unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks, potentially leading to execution of arbitrary scripts in users' browsers. The CVSS 3.1 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes partial loss of confidentiality, integrity, and availability.

Successful exploitation can lead to execution of malicious scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider applying workarounds recommended by the vendor or restrict access to the affected functionality to trusted users only.