Since the here-document is indicated by <<EOF (without any quotes), the content of the here-document is subject to expansion of \$`. Hence $newUrl in the here document expands to its value in the local shell.
To instead pass $newUrl to the remote shell and have it expand the variable, you can protect the $ from expansion: \$newUrl instead of $newUrl, or use a literal here-document: <<'EOF' instead of ``<
You're expanding the variable newUrl in a string which is going to be interpreted by a shell. This means that the value of the variable will be interpreted as a shell script fragment, not as a string. If the value contains shell special characters, havoc will ensue. (Which characters are problematic depends on which works-in-the-nominal-case solution you use.)
Instead of using many layers of quoting and expansion, pass the URL as input to the command running as root. Then you have nothing to worry about. This has the added advantage of working even if sudo is not configured to accept -E, which is fairly common. You can use sudo sh -c 'cat >>/path/to/file', or better, to avoid any potential quoting issues on the file, sudo tee -a /path/to/file.
sshpass -p "password" ssh -t -t my-box <<'EOF'
newUrl="this is a url"
printf '%s\n' "$newUrl" | sudo tee -a /path/to/file
EOF
