CVE-2020-35933: 
NixOS vulnerability analysis and mitigation

A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability was discovered in the WordPress Newsletter plugin versions before 6.8.2. The vulnerability, identified as CVE-2020-35933, was disclosed on December 31, 2020, affecting over 300,000 WordPress sites (Wordfence Blog).

The vulnerability allows remote attackers to execute a cross-site scripting attack by tricking victims into submitting a tnpc_render AJAX request. The attack can be performed in two ways: either by including JavaScript in an options parameter or by using a base64-encoded JSON string containing JavaScript in the encoded_options parameter. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability impacts the confidentiality, integrity, and availability of affected systems, all rated as Low according to the CVSS scoring. The vulnerability affects a significant number of WordPress installations, with over 300,000 sites potentially at risk (Wordfence Blog).

The exploit requires low attack complexity but does need low privileges and user interaction to be successful. The vulnerability is network-accessible and requires the attacker to trick an authenticated user into performing specific actions (NVD).

The vulnerability has been patched in Newsletter plugin version 6.8.2. Users are advised to update to this version or later to mitigate the risk (Wordfence Blog).