Newsletter < 9.4.1 - Unauthenticated Stored XSS via 'np1' Custom Field Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'np1' custom field parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page. The subscription endpoint requires no nonce, capability check or CAPTCHA, and the payload can be smuggled past email-address validation by embedding the {profile_1} placeholder in the local part of the submitted address, since is_email() permits curly braces there.