title: Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting
description: The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Newsletter – Send awesome emails from WordPress
vendor: Unknown
versions:
lessThan: 7.4.6, status: affected, version: 7.4.6, versionType: custom
}