CVE-2026-12938 | Newsletters Lite Plugin up to 4.15 on WordPress Shortcode posts_single/shortcode_posts Target cross site scripting

A vulnerability classified as problematic has been found in Newsletters Lite Plugin up to 4.15 on WordPress. This issue affects the function posts_single/shortcode_posts of the component Shortcode Handler. The manipulation of the argument Target leads to cross site scripting.

This vulnerability is uniquely identified as CVE-2026-12938. The attack is possible to be carried out remotely. No exploit exists.