Reflected Cross-Site Scripting in Nouri.sh Newsletter Plugin for WordPress

CVE-2025-13515

What is CVE-2025-13515?

The Nouri.sh Newsletter plugin for WordPress is susceptible to reflected cross-site scripting due to inadequate input sanitization and output escaping when processing the $_SERVER['PHP_SELF'] parameter. This vulnerability permits unauthenticated attackers to inject malicious web scripts into pages viewed by users. If successfully executed, these scripts can compromise user sessions or deceive users into performing harmful actions, especially if they are manipulated into clicking on targeted links.

References