CVE-2022-1756

The Newsletter plugin versions before 7.4.5 fail to properly sanitize the $_SERVER['REQUEST_URI'] variable before displaying it on administrative pages, creating a reflected cross-site scripting vulnerability. While the code applies addslashes and contemporary browsers typically URL-encode requests automatically, this protection proves insufficient against older browser versions like Internet Explorer 9 and earlier. An attacker could exploit this weakness by crafting a malicious URI to execute arbitrary scripts in the context of an administrator's session when viewed through a vulnerable browser.

Based on public CVE data (MITRE/NVD).