PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111830 WP Mailster CVE debrief

A Cross-site Scripting (XSS) vulnerability exists in the WordPress WP Mailster plugin up to version 1.9.1.0. This issue allows for Stored XSS, potentially enabling attackers to inject malicious scripts into web pages viewed by other users. The vulnerability can lead to unauthorized actions or data exposure. Defenders should assess exposure and prioritize updates to mitigate this vulnerability. The CVE Program and NVD have documented this vulnerability, providing details on its existence and potential impact. To address this vulnerability, defenders should review and monitor user input to prevent malicious script injection. The WP Mailster plugin has a Stored Cross-site Scripting (X

Vendor
WP Mailster
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for WordPress installations with the WP Mailster plugin should assess exposure and prioritize updates to mitigate this vulnerability.

Why it matters

CVE-2026-111830 is a Stored Cross-site Scripting (XSS) vulnerability in the WordPress WP Mailster plugin up to version 1.9.1.0. Defenders should prioritize updating to version 1.9.2.0 or later and monitor user input to prevent malicious script injection.

  • Potential for malicious script injection into web pages viewed by other users
  • Possible unauthorized actions or data exposure due to XSS
  • Need for defenders to verify and update WP Mailster plugin versions
  • Importance of monitoring user input to prevent exploitation

Technical summary

The WP Mailster plugin for WordPress has a Stored Cross-site Scripting (XSS) vulnerability in versions up to 1.9.1.0. This vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data exposure.

Defensive priority

Defenders should prioritize updating the WP Mailster plugin to version 1.9.2.0 or later to address this vulnerability.

Recommended defensive actions

  • Update WP Mailster plugin to version 1.9.2.0 or later
  • Review and monitor user input to prevent malicious script injection
  • Implement Content Security Policy (CSP) to mitigate XSS attacks

Evidence notes

The CVE Program and NVD have documented this vulnerability, providing details on its existence and potential impact. The vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data exposure. Defenders should verify and update WP Mailster plugin versions and monitor user input to prevent exploitation. The official CVE Program record and NVD detail page provide source-specific vulnerability assessments. The source item c

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111830 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111830

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111830 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111830

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.