CVE-2026-90981 is a reflected cross-site scripting vulnerability in the Newsletter – Send awesome emails from WordPress plugin affecting versions up to 9.3.8. The issue is due to improper neutralization of input during web page generation, specifically via the 'nn' parameter. An unauthenticated attacker can craft a malicious link containing a script payload that executes in the context of a logged-in administrator's browser because the antibot check automatically passes for authenticated users, routing the unsanitized input through an administrator-visible output function (dienow()). This allows injection of arbitrary scripts leading to potential information disclosure or session hijacking limited to administrator users.

Successful exploitation requires the victim to be a logged-in administrator who clicks a malicious link. The attacker can execute arbitrary scripts in the administrator's browser context, potentially leading to information disclosure or other actions permitted by the administrator's privileges. The vulnerability does not allow privilege escalation or denial of service but compromises confidentiality and integrity at the administrator level.

No official patch or fix is currently provided by the vendor. Users should apply strict input validation and output escaping as a temporary mitigation. Administrators should avoid clicking on untrusted links and consider restricting access to the plugin or disabling it until a fix is available. Monitor the vendor advisory for updates regarding an official fix.