CVE-2025-2009

CVE-2025-2009 is a stored cross-site scripting (XSS) vulnerability in the Newsletters plugin for WordPress, affecting all versions up to and including 4.9.9.7. The flaw arises in the logging functionality due to insufficient input sanitization and output escaping, allowing arbitrary web scripts to be injected into pages. It is classified under CWE-79 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and changed scope.

Unauthenticated attackers can exploit this vulnerability remotely by injecting malicious scripts through the logging mechanism. Once injected, the scripts persist in pages and execute in the context of any user who accesses those pages, potentially leading to session hijacking, data theft, or further site compromise depending on the victim's privileges.

References include Wordfence's threat intelligence advisory detailing the issue, along with WordPress plugin trac links to the vulnerable code in views/admin/settings/view_logs.php at line 107 and a subsequent changeset 3257980, which indicates a patch addressing the sanitization and escaping deficiencies. Security practitioners should update the plugin beyond version 4.9.9.7 to mitigate the risk.