WordPress Newsletter plugin < 8.8.5 - Admin+ Stored XSS via Form vulnerability

Admin+ Stored XSS via Form vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Newsletter versions 8.8.5...

CVE-2025-3582

The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-3582

The Newsletter WordPress plugin in versions prior to 8.85 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain Form settings . This flaw allows high-privilege users, such as administrators, to perform XSS attacks, even in envir...