CVE-2026-96566 is a stored cross-site scripting vulnerability (CWE-79) in the Newsletter – Send awesome emails from WordPress plugin affecting versions up to 9.4.0. The flaw exists due to insufficient sanitization and escaping of the 'np1' custom field parameter, enabling unauthenticated attackers to inject arbitrary web scripts. The subscription endpoint (na=sa) does not enforce nonce, capability checks, or CAPTCHA protections, and the payload can bypass email validation by exploiting WordPress's is_email() function allowing curly braces in the local part of email addresses. This results in persistent script injection that executes when users view the injected content.

An unauthenticated attacker can inject persistent malicious scripts into pages served by the vulnerable plugin, which execute in the context of users accessing those pages. This can lead to information disclosure and integrity impacts (confidentiality and integrity loss), but no availability impact is noted. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.

No official patch or fix is currently referenced in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the vulnerable plugin or restricting access to the subscription endpoint to trusted users. Monitoring for suspicious activity related to the 'np1' parameter and email submissions containing curly braces may help detect exploitation attempts.