CVE-2025-0953: Yaycommerce Yaysmtp XSS Vulnerability

CVE-2025-0953 Overview

CVE-2025-0953 affects the SMTP for Sendinblue – YaySMTP plugin for WordPress in all versions up to and including 1.2. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw [CWE-79] caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages, and the payload executes whenever a user views the affected page. Successful exploitation can lead to session theft, credential harvesting, redirection to attacker-controlled sites, and administrative account compromise when a privileged user views the injected content.

Critical Impact
Unauthenticated stored XSS enables persistent script injection that executes in the browser of any visitor, including WordPress administrators.

Affected Products

YayCommerce SMTP for Sendinblue – YaySMTP plugin for WordPress, versions up to and including 1.2
WordPress sites with the smtp-sendinblue plugin installed and active
Any WordPress installation using vulnerable versions of the YaySMTP plugin

Discovery Timeline

2025-02-22 - CVE-2025-0953 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0953

Vulnerability Analysis

The vulnerability resides in the YaySMTP plugin, an SMTP integration for WordPress that routes outgoing mail through Sendinblue (Brevo). The plugin fails to sanitize user-controlled input before it is stored and fails to escape the same data when it is rendered in HTML output. The relevant plugin logic is implemented in includes/Functions.php and includes/Helper/Utils.php, as referenced in the WordPress SMTP Function File and WordPress SMTP Helper File.

Because the injection point is reachable without authentication, an attacker does not need credentials to plant a payload. The stored script executes in every visitor's browser session, running with the privileges of the viewing user. When a WordPress administrator triggers the payload, the attacker can leverage the admin session to create accounts, alter plugin configuration, or install additional malicious code.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render. WordPress provides functions such as sanitize_text_field(), wp_kses_post(), and esc_html() for these controls, but the vulnerable code paths do not apply them consistently to attacker-controlled fields. The fix landed in WordPress Change Set #3270561.

Attack Vector

Exploitation is remote and requires user interaction, meaning the victim must load the page containing the stored payload. An unauthenticated attacker submits a crafted request containing a JavaScript payload to a vulnerable plugin endpoint. The payload is persisted server-side and later reflected into HTML output without escaping. See the Wordfence Vulnerability Report for advisory details.

Detection Methods for CVE-2025-0953

Indicators of Compromise

Unexpected <script>, onerror=, or onload= fragments stored in WordPress database tables associated with plugin settings or logs
Outbound requests from visitor browsers to unfamiliar third-party domains after loading pages that render YaySMTP plugin data
New or modified WordPress administrator accounts created shortly after administrator visits to plugin-related pages
Unrecognized modifications to plugin configuration in the wp_options table

Detection Strategies

Inventory WordPress installations and identify sites running the smtp-sendinblue plugin at version 1.2 or earlier
Review web server access logs for POST requests to plugin endpoints containing HTML-encoded or raw script tags
Scan the WordPress database for stored payloads matching common XSS patterns such as <script, javascript:, and event handler attributes
Deploy web application firewall (WAF) rules that flag script content in requests destined for plugin AJAX or REST handlers

Monitoring Recommendations

Enable file integrity monitoring on the WordPress plugin directory to detect unauthorized modification of plugin code
Alert on creation of new administrator-level WordPress accounts and on changes to user roles
Monitor Content Security Policy (CSP) violation reports for inline script executions on admin and public pages

How to Mitigate CVE-2025-0953

Immediate Actions Required

Update the SMTP for Sendinblue – YaySMTP plugin to the patched version released after change set 3270561
Audit the WordPress database and plugin settings for stored payloads and remove any injected script content
Review recent administrator activity and rotate credentials for any accounts that may have loaded a malicious page

Patch Information

The vendor addressed the flaw in the commit tracked as WordPress Change Set #3270561. Administrators should install the latest release listed on the WordPress SMTP Developer Page. Verify the installed version through the WordPress admin plugin listing after the update completes.

Workarounds

Deactivate and remove the YaySMTP plugin until the patched version can be installed
Deploy a WAF rule set that blocks requests containing script tags or JavaScript event handlers to plugin endpoints
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Configuration example: verify plugin version and force update via WP-CLI
wp plugin get smtp-sendinblue --field=version
wp plugin update smtp-sendinblue
wp plugin deactivate smtp-sendinblue   # temporary workaround if patch unavailable