CVE-2025-1319

High

Published: 28 February 2025

Published

28 February 2025

Modified

08 April 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0038 59.6th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1319 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Elementor Site Mailer. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked in the top 40.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Browser Session Hijacking (T1185) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of all user inputs to detect and reject malicious scripts, directly addressing the insufficient input sanitization causing this stored XSS vulnerability.

SI-15 Information Output Filtering good match

prevent

Mandates filtering and encoding of outputs to prevent execution of injected scripts when pages are accessed, countering the lack of output escaping in the vulnerable plugin.

SI-2 Flaw Remediation good match

prevent

Ensures timely identification, reporting, and patching of flaws like this stored XSS in the WordPress plugin, preventing exploitation through remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

Why these techniques?

Stored XSS enables browser session hijacking and theft of web session cookies via injected scripts.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it…

possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Deeper analysisAI

CVE-2025-1319, published on 2025-02-28, is a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress. It affects all versions up to and including 1.2.3 due to insufficient input sanitization and output escaping. The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity with network accessibility, low attack complexity, no privileges or user interaction required, and changed scope.

Unauthenticated attackers can exploit this vulnerability remotely by injecting arbitrary web scripts through the plugin, which are then stored and executed in the context of affected pages whenever any user accesses them. This allows potential theft of session cookies, deflection of users to malicious sites, or other client-side attacks, resulting in low impacts to confidentiality and integrity.

Advisories and patch details are provided in references including WordPress plugin trac changeset 3247059, the plugin's developers page on WordPress.org, and Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/c9fe3574-f338-474c-af78-f843501d422c?source=cve. Security practitioners should review these for specific mitigation steps, such as applying the patch or updating the plugin.