The Nouri.sh Newsletter WordPress plugin contains a reflected Cross‑Site Scripting flaw that is triggered through the $_SERVER['PHP_SELF'] variable in all versions up to 1.0.1.3. The plugin fails to sanitize or escape the value before sending it back in the response, allowing an attacker to inject arbitrary JavaScript. When a victim follows a crafted link, the script runs in the victim’s browser with the privileges of that user, enabling session hijacking, cookie theft, defacement, or the execution of further malicious payloads.

All installations of the Nouri.sh Newsletter plugin with a version number less than or equal to 1.0.1.3 are vulnerable. The product, created by the vendor danrajkumar, is commonly used in WordPress sites to turn RSS feeds into email newsletters.

The vulnerability has a CVSS score of 6.1, indicating a moderate severity. Its EPSS score is below 1%, suggesting that exploitation attempts are currently uncommon. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to arrange for a victim to visit a URL that contains malicious content, typically by sending a phishing link. While the attack vector relies on user interaction, the impact of a successful attack can be significant due to the ability to run arbitrary client‑side code.