CVE-2025-0918

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0918", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-31T00:06:27.898Z", "datePublished": "2025-02-22T12:39:21.418Z", "dateUpdated": "2026-06-04T14:45:40.318Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:05.508Z"}, "affected": [{"vendor": "yaycommerce", "product": "SMTP for SendGrid \u2013 YaySMTP", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SMTP for SendGrid \u2013 YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "SMTP for SendGrid \u2013 YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b98f2a85-9535-4bf5-900c-f4f630c7b502?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/smtp-sendgrid/trunk/includes/Functions.php"}, {"url": "https://wordpress.org/plugins/smtp-sendgrid/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3270556/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Cristian Bejan"}], "timeline": [{"time": "2025-01-31T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-01-31T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-02-22T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-24T12:51:34.639779Z", "id": "CVE-2025-0918", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T14:45:40.318Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0918", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-24T12:51:34.639779Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-24T12:51:41.632Z"}}], "cna": {"title": "SMTP for SendGrid \u2013 YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs", "credits": [{"lang": "en", "type": "finder", "value": "Cristian Bejan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "yaycommerce", "product": "SMTP for SendGrid \u2013 YaySMTP", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-31T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-01-31T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-02-22T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b98f2a85-9535-4bf5-900c-f4f630c7b502?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/smtp-sendgrid/trunk/includes/Functions.php"}, {"url": "https://wordpress.org/plugins/smtp-sendgrid/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3270556/"}], "descriptions": [{"lang": "en", "value": "The SMTP for SendGrid \u2013 YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:05.508Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0918", "state": "PUBLISHED", "dateUpdated": "2026-06-04T14:45:40.318Z", "dateReserved": "2025-01-31T00:06:27.898Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-22T12:39:21.418Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SMTP for SendGrid \u2013 YaySMTP", "vendor": "yaycommerce", "versions": [{"lessThanOrEqual": "1.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:yaycommerce:yaysmtp:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "47DFF634-7BAD-4340-8435-31C67286B4D7", "versionEndExcluding": "1.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SMTP for SendGrid \u2013 YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento SMTP para SendGrid \u2013 YaySMTP para WordPress es vulnerable a Cross-Site Scripting almacenado en versiones hasta la 1.3.1 incluida debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida. Esto permite que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-0918", "lastModified": "2026-06-17T08:27:22.310", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0918", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-24T12:51:34.639779Z", "version": "2.0.3"}}]}, "published": "2025-02-22T13:15:11.687", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/smtp-sendgrid/trunk/includes/Functions.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3270556/"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/smtp-sendgrid/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b98f2a85-9535-4bf5-900c-f4f630c7b502?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T02:06:48.377081+00:00", "value": {"mitigation_remediation": ["Upgrade the SMTP for SendGrid \u2013 YaySMTP plugin to the latest version, which removes the XSS vulnerability.", "If a patch cannot be applied immediately, disable the email log viewing feature or restrict its access to trusted administrator accounts to prevent script execution.", "Implement a web application firewall or enforce strict input validation on the WordPress site to block or sanitize malicious payloads targeting the plugin\u2019s email logging endpoints."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Any WordPress site that has installed the yaycommerce SMTP for SendGrid \u2013 YaySMTP plugin version 1.4 or earlier is affected. The vulnerability is present in the email logging functionality of the plugin and does not depend on additional configuration beyond the presence of the plugin itself.", "description_and_impact": "The SMTP for SendGrid \u2013 YaySMTP plugin for WordPress, in versions up to and including 1.4, suffers from a stored cross\u2011site scripting flaw. Insufficient input sanitization and output escaping in the email logging component permit an unauthenticated attacker to insert arbitrary JavaScript into log entries. When a user opens a page that displays such a log entry, the injected script runs in the user\u2019s browser, potentially altering the page\u2019s appearance or behaviour as defined by the attacker.", "risk_and_exploitability": "With a CVSS score of 7.2 the flaw is considered high severity, but the EPSS score of less than 1\u202f% indicates that exploitation is currently unlikely. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by sending log entries containing malicious scripts; the scripts are executed whenever a site user or administrator views the affected log page, providing the attacker a persistent client\u2011side vector."}}}}, "created": "2026-04-22T02:15:05.411998+00:00", "updated": "2026-04-22T02:15:05.412009+00:00", "vendors": []}