CVE-2026-12939 is a stored cross-site scripting vulnerability in the Newsletters Lite WordPress plugin (contrid project) affecting versions up to 4.15. The issue is due to insufficient input sanitization and output escaping in the post_thumbnail() method within helpers/shortcode.php. Specifically, the user-controlled 'link' shortcode attribute is concatenated directly into an href attribute without proper escaping functions such as esc_url() or esc_attr(). This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts that execute in the context of users visiting the injected pages.

An attacker with contributor-level or higher access can inject malicious scripts into pages via the vulnerable shortcode attribute. These scripts execute in the browsers of users who view the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability and requires authenticated access, but it compromises confidentiality and integrity of user sessions or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable shortcode usage. Monitoring for suspicious activity related to injected scripts is advisable.