CVE-2025-2009

CVE-2025-2009 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Newsletters plugin for WordPress, affecting all versions up to and including 4.9.9.7. This flaw stems from insufficient input sanitization and output escaping in the plugin's logging functionality. Unauthenticated attackers can exploit this to inject malicious web scripts into pages, which then execute when a user views the compromised page. The vulnerability carries a CVSS score of 7.2 (HIGH), indicating a network-based attack vector with low complexity, requiring no user interaction or privileges. Successful exploitation could lead to information disclosure and integrity compromise (C:L/I:L), but not availability impact. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, aligning with the typical low engagement seen for most vulnerabilities.