CVE-2025-13515 is a reflected cross-site scripting vulnerability in the Nouri.sh Newsletter plugin for WordPress, affecting all versions up to and including 1.0.1.3. The vulnerability is due to improper neutralization of input in the $_SERVER['PHP_SELF'] parameter, leading to execution of arbitrary web scripts when a user clicks a maliciously crafted link. The vulnerability requires no privileges but does require user interaction. The CVSS 3.1 score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of the affected website, potentially leading to partial disclosure of confidential information and modification of data. There is no impact on availability. The vulnerability requires user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links that could exploit this vulnerability. Monitoring for updates from the plugin vendor or WordPress security channels is recommended.