What is GHSA-xhvp-v8j9-2mrf?

GHSA-xhvp-v8j9-2mrf is a security advisory published by GitHub Security Advisories with Medium severity. The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect...

Which CVE IDs does GHSA-xhvp-v8j9-2mrf cover?

GHSA-xhvp-v8j9-2mrf covers the following CVE IDs: CVE-2026-86823. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xhvp-v8j9-2mrf?

GHSA-xhvp-v8j9-2mrf has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-xhvp-v8j9-2mrfMediumCVSS 5.3

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect...

Vendor

GitHub Security Advisories

Published

September 16, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-86823 →

📋 Description

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber record's front-end actions.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-86823
https://wpscan.com/vulnerability/2db98679-24ca-494e-a8fd-f6417a0f1ea8
https://github.com/advisories/GHSA-xhvp-v8j9-2mrf