CVE-2022-1756: Newsletter < 7.4.5 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-13 · updated 2026-06-17
Weakness: CWE-79

Description

The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.

Affected products

satollo Newsletter – Send awesome emails from WordPress: before 7.4.5 — fixed in 7.4.5

How to fix

Upgrade to a fixed version: satollo Newsletter – Send awesome emails from WordPress 7.4.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-1756 or the next vulnerability affects your stack