CVE-2020-35933

The Newsletter plugin through version 6.8.1 contains an authenticated reflected cross-site scripting vulnerability in the tnpc_render AJAX action. An authenticated attacker can inject malicious JavaScript by manipulating the options or encoded_options parameters sent to the wp-admin/admin-ajax.php endpoint, allowing arbitrary script execution in the context of an administrator's browser session. The vulnerability exists because user-supplied input is decoded and rendered without proper sanitization, enabling code injection through multiple parameter vectors.

Based on public CVE data (MITRE/NVD).