CVE-2025-1123

Deeper analysis

The Solid Mail – SMTP email and logging plugin for WordPress, developed by SolidWP, is affected by a stored cross-site scripting vulnerability in all versions through 2.1.5. The flaw stems from insufficient input sanitization and output escaping on the Name, Subject, and Body fields of processed emails, allowing arbitrary script injection into pages that render the logged content.

Unauthenticated attackers can supply malicious payloads via SMTP email submissions, which are stored by the plugin and later executed in the browsers of users who view the affected logs or related pages. Successful exploitation yields script execution with a CVSS 7.2 rating reflecting network attack vector, no required credentials, and impact confined to confidentiality and integrity.

The referenced WordPress plugin changeset 3283671 and Wordfence advisory indicate that the issue is resolved by updating to a patched release beyond 2.1.5. The EPSS score has remained flat at 0.0103 with no material increase since disclosure.