CVE-2025-3583: Newsletter < 8.7.1 - Admin+ Stored XSS
The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3583?
CVE-2025-3583 has a medium severity rating due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2025-3583?
To fix CVE-2025-3583, update the Newsletter WordPress plugin to version 8.7.1 or higher.
Who is affected by CVE-2025-3583?
CVE-2025-3583 affects high privilege users, particularly admins in WordPress installations using the Newsletter plugin before version 8.7.1.
What type of vulnerability is CVE-2025-3583?
CVE-2025-3583 is a Stored Cross-Site Scripting vulnerability caused by improper sanitization and escaping of settings.
Can CVE-2025-3583 affect multisite setups?
Yes, CVE-2025-3583 can affect multisite setups where unfiltered_html capability is disallowed.