CVE-2026-66596: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Stefano Lissa Newsletter

This vulnerability, identified as CWE-79, affects Newsletter software versions up to 9.3.3. It is an unauthenticated Cross-Site Scripting (XSS) issue where user input is not properly sanitized before being included in web pages, enabling attackers to execute arbitrary scripts in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, potentially resulting in partial disclosure of information, modification of data, and disruption of service availability within the affected application context. The vulnerability requires no authentication but does require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing web application firewall rules or input sanitization as temporary mitigations.