CVE-2024-13098: 
WordPress vulnerability analysis and mitigation

The WordPress Email Newsletter WordPress plugin through version 1.1 contains a Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered in early 2025 and assigned CVE-2024-13098. The issue affects high-privilege users such as administrators (WPScan, NVD).

The vulnerability stems from improper sanitization and escaping of a parameter before it is output back in the page. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The vulnerability can be exploited through the admin interface at the path 'wp-admin/admin.php?page=view-subscriber&search=' (WPScan, NVD).

When successfully exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the context of high-privilege users' browsers, potentially leading to account compromise or other malicious actions (WPScan).

A proof of concept exists demonstrating the vulnerability using the URL pattern: 'https://example.com/wp-admin/admin.php?page=view-subscriber&search=ds">alert(1)' (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the WordPress Email Newsletter plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).