CVE-2023-27922

The Newsletter plugin for WordPress up to version 7.6.8 contains a reflected cross-site scripting vulnerability in the $_SERVER['REQUEST_URI'] parameter caused by inadequate sanitization and escaping of user input. An unauthenticated attacker could exploit this flaw by crafting a malicious link that injects arbitrary JavaScript code into a page, which would execute if a user clicks the link, though the vulnerability primarily affects users with older browsers since newer browsers automatically URL-encode the REQUEST_URI parameter.

Based on public CVE data (MITRE/NVD).