CVE-2025-3583 in Newsletter Plugin
Résumé (Anglaise)
The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Responsable
WPScan
Réserver
14/04/2025
Divulgation
05/05/2025
Statut
Confirmé
Entrées
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnérabilité | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 307384 | Newsletter Plugin Setting cross site scripting | 79 | Non défini | Correctif officiel | CVE-2025-3583 |