CVE-2025-3583 in Newsletter Plugin

Summary

The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Responsible

WPScan

Reservation

04/14/2025

Disclosure

05/05/2025

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
307384	Newsletter Plugin Setting cross site scripting	79	Not defined	Official fix	CVE-2025-3583