Cross-site Scripting Vulnerability in EELV Newsletter Plugin

CVE-2025-23602

What is CVE-2025-23602?

The EELV Newsletter plugin exposes a reflected Cross-site Scripting (XSS) vulnerability, enabling attackers to inject malicious scripts into web pages. This critical security flaw allows unauthorized parties to execute scripts in the user's browser, potentially leading to data theft, session hijacking, or other malicious activities. Affected versions of the plugin include all releases up to 4.8.2. It is essential for site administrators to update the plugin and implement appropriate security measures to protect against such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References