CVE-2026-12938 is a stored cross-site scripting vulnerability in the Newsletters Lite WordPress plugin (contrid project). The issue occurs due to insufficient input sanitization and output escaping in the posts_single() function and the shortcode_posts() 'post_thumbnail' handler. Specifically, the attacker-controlled 'target' attribute from the [newsletters_post] shortcode is assigned to the global variable $wpml_target and then concatenated into an HTML target attribute without proper escaping (esc_attr()). This allows authenticated users with Contributor-level privileges or higher to inject arbitrary JavaScript that executes in the context of users viewing the injected pages. The vulnerability affects versions up to and including 4.15. No official patch or remediation level has been published yet.

An authenticated attacker with Contributor-level access or higher can exploit this vulnerability to inject and store malicious JavaScript code within pages generated by the plugin. This code executes in the browsers of users who visit the affected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user interactions with the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the [newsletters_post] shortcode with the 'target' attribute. Monitor for updates from the plugin vendor or WordPress security channels for an official patch or workaround.