Stored Cross-Site Scripting in WP Test Email Plugin by WordPress
CVE-2025-2325

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
WP Test Email
Vendor
CVE Published:
15 March 2025

What is CVE-2025-2325?

The WP Test Email plugin for WordPress contains a flaw that allows stored cross-site scripting (XSS) due to a lack of proper input validation and output encoding in its email logs. This vulnerability can be exploited by unauthenticated attackers, enabling them to inject arbitrary web scripts into pages. These injected scripts will execute in the browsers of users who access affected pages, posing a serious security risk.

Affected Version(s)

WP Test Email * <= 1.1.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Silent Breach
.
CVE-2025-2325 : Stored Cross-Site Scripting in WP Test Email Plugin by WordPress