CVE-2025-23602

CVE-2025-23602 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the EELV Newsletter WordPress plugin developed by Europe Ecologie Les Verts. The issue impacts all versions of the plugin up to and including 4.8.2. It has a CVSS v3.1 base score of 7.1, reflecting medium severity with network accessibility, low attack complexity, no required privileges, user interaction needed, changed scope, and low impacts to confidentiality, integrity, and availability.

Unauthenticated attackers can exploit this vulnerability remotely by crafting malicious links that, when clicked by users visiting affected WordPress sites with the plugin enabled, inject and execute arbitrary JavaScript in the victim's browser context. Successful exploitation enables attackers to steal session cookies, perform actions on behalf of the user, or deface pages, leveraging the reflected nature for phishing or session hijacking scenarios requiring user interaction.

Patchstack documents this vulnerability in their database, highlighting the Reflected XSS in the EELV Newsletter plugin version 4.8.2 and providing details for WordPress administrators to assess exposure.