CVE-2025-2009 is a stored cross-site scripting vulnerability in the contrid Newsletters plugin for WordPress, affecting all versions up to and including 4.9.9.7. The issue stems from improper neutralization of input during web page generation, specifically in the logging functionality, which fails to sanitize and escape user-supplied input. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users accessing the injected pages. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no reported impact on availability. No known exploits are currently documented in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin's functionality or disabling the plugin if feasible to reduce exposure.