CVE-2025-2325
Published: 15 March 2025
Summary
CVE-2025-2325 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Boopathirajan Wp Test Email. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-2325 is a stored cross-site scripting (XSS) vulnerability in the WP Test Email plugin for WordPress, affecting all versions up to and including 1.1.8. The issue stems from insufficient input sanitization and output escaping in the Email Logs feature, enabling the injection of arbitrary web scripts into pages.
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity, no privileges, and no user interaction required. By injecting malicious scripts via email logs, attackers can cause the scripts to execute whenever any user accesses the affected pages, achieving low impacts on confidentiality and integrity with a changed scope, as reflected in the CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Advisories and patches are referenced in the WordPress plugin trac changeset for the WP Test Email repository and Wordfence threat intelligence page, providing details on remediation for this CWE-79 vulnerability, which was published on 2025-03-15.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6633
Vulnerability details
The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
more
inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in user browsers when viewing affected pages.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces input validation and sanitization to prevent injection of malicious scripts into email logs due to insufficient input sanitization.
Mandates output filtering and escaping to block execution of injected scripts when pages are accessed, addressing the lack of output escaping.
Requires identification, reporting, and correction of the specific flaw in the WP Test Email plugin, including timely patching to remediate the stored XSS vulnerability.