Cross-site Scripting Vulnerability in EELV Newsletter Plugin

CVE-2025-23602

What is CVE-2025-23602?

The EELV Newsletter plugin exposes a reflected Cross-site Scripting (XSS) vulnerability, enabling attackers to inject malicious scripts into web pages. This critical security flaw allows unauthorized parties to execute scripts in the user's browser, potentially leading to data theft, session hijacking, or other malicious activities. Affected versions of the plugin include all releases up to 4.8.2. It is essential for site administrators to update the plugin and implement appropriate security measures to protect against such vulnerabilities.

References