CVE-2023-47517 HIGH

CVE-2023-47517: WordPress SendPress Newsletters Plugin <= 1.23.11.6 is vulnerable to Cross Site Scripting (XSS)

Vendor Sendpress
Product SendPress Newsletters
Weakness CWE-79 · XSS
Published November 14, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.23.11.6 versions.

Explanation of Vulnerability in Simple Terms

02Summary

SendPress Newsletters versions up to 1.23.11.6 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction—typically clicking a malicious link—and can affect users across different parts of the application. An attacker with no authentication can craft a payload that executes in a victim's browser, potentially stealing session data or performing actions on their behalf.

What an attacker can do

03Attacker Capabilities

Inject malicious JavaScript that runs in other users' browsers when they visit a crafted link.

Potential impact on your site

04Site Impact

Users' accounts and data are at risk if they click malicious links; attackers can steal sessions or perform unauthorized actions.

Conditions required to exploit

05Prerequisites

Victim must click a malicious link or visit an attacker-controlled page; no authentication required.

Key dates

06Disclosure timeline

November 14, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-27426 WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-57358 WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-57762 WordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerability CVE-2026-57366 WordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-57670 WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability