CVE-2025-0957: YaySMTP WordPress Plugin XSS Vulnerability

CVE-2025-0957 Overview

CVE-2025-0957 is a stored Cross-Site Scripting (XSS) vulnerability in the SMTP for Amazon SES – YaySMTP plugin for WordPress. The flaw affects all versions up to and including 1.7.1. The root cause is insufficient input sanitization and output escaping within the plugin's helper functions. Unauthenticated attackers can inject arbitrary JavaScript that executes when any user visits an affected page. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Unauthenticated attackers can persist malicious scripts in WordPress pages, enabling session theft, administrative account takeover, and arbitrary client-side actions against site visitors and administrators.

Affected Products

• SMTP for Amazon SES – YaySMTP plugin for WordPress (versions ≤ 1.7.1)
• WordPress sites with the smtp-amazon-ses plugin installed and active
• Any WordPress administrator or visitor accessing pages rendered with the unsanitized plugin output

Discovery Timeline

• 2025-02-22 - CVE-2025-0957 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-0957

Vulnerability Analysis

The YaySMTP plugin handles SMTP configuration and email-related data for sites sending mail through Amazon Simple Email Service (SES). The vulnerable code paths reside in includes/Functions.php and includes/Helper/Utils.php, which process plugin input and emit values into WordPress pages.

Because these functions neither sanitize input on save nor escape output on render, attacker-supplied content reaches the Document Object Model (DOM) unmodified. A persistent payload stored through an exposed entry point executes whenever the affected page loads in a browser. The Exploit Prediction Scoring System (EPSS) probability is 0.295%.

With network attack vector, no privileges required, and a scope change to other components, an attacker can pivot from the plugin context into the broader WordPress administrative interface. Successful exploitation can lead to administrator account compromise, malicious redirects, SEO spam injection, or cryptocurrency drainer scripts.

Root Cause

The vulnerability stems from missing calls to WordPress sanitization functions such as sanitize_text_field() on input and missing escaping helpers such as esc_html(), esc_attr(), or wp_kses() on output. Attacker-controlled strings are stored to the database and later concatenated into HTML contexts without neutralization.

Attack Vector

An unauthenticated remote attacker submits a crafted payload to a plugin endpoint that writes to a persisted setting or data field. The injected JavaScript is later rendered when an administrator or visitor loads a page containing the unsanitized value. Because the payload is stored server-side, every subsequent visitor triggers the script, including privileged users whose session cookies or nonce tokens can be exfiltrated.

No verified public proof-of-concept code is currently published for this vulnerability. Technical details on the patched functions are available in the WordPress Changeset #3270161 and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-0957

Indicators of Compromise

• Unexpected <script>, <iframe>, or onerror= strings stored in WordPress wp_options rows associated with the smtp-amazon-ses plugin.
• Outbound requests from administrator browsers to unfamiliar domains shortly after loading plugin settings or site pages.
• New or modified administrator accounts created without a corresponding authenticated session in WordPress logs.
• Page source containing JavaScript that does not match the site's known theme, plugin, or analytics inventory.

Detection Strategies

• Audit the WordPress database for plugin option values containing HTML or JavaScript syntax using queries against wp_options and plugin-specific tables.
• Review web server access logs for unauthenticated POST requests to YaySMTP plugin endpoints under /wp-content/plugins/smtp-amazon-ses/.
• Run a static scanner such as Wordfence or a comparable WordPress security plugin to flag stored XSS signatures in plugin data.

Monitoring Recommendations

• Alert on creation or modification of WordPress administrator accounts and on changes to plugin settings outside authorized maintenance windows.
• Monitor browser telemetry from administrative workstations for script execution originating from the WordPress admin domain to external hosts.
• Track plugin version inventory across managed WordPress fleets and flag any host still running smtp-amazon-ses ≤ 1.7.1.

How to Mitigate CVE-2025-0957

Immediate Actions Required

• Update the SMTP for Amazon SES – YaySMTP plugin to the version released in WordPress Changeset #3270161 (above 1.7.1).
• Inspect plugin option values and post content for previously injected payloads and remove any malicious markup.
• Rotate WordPress administrator passwords and invalidate active sessions after confirming the site is clean.
• Force a refresh of WordPress secret keys in wp-config.php to invalidate stolen authentication cookies.

Patch Information

The vendor addressed the issue by adding proper sanitization and escaping in includes/Functions.php and includes/Helper/Utils.php. The fix is published in WordPress Changeset #3270161. Refer to the WordPress Plugin Developer Info page to confirm the currently installed version and download the patched release.

Workarounds

• Deactivate and remove the smtp-amazon-ses plugin until it can be updated to a patched version.
• Restrict access to /wp-admin/ and plugin endpoints with a Web Application Firewall (WAF) rule blocking HTML or script characters in request bodies targeting the plugin.
• Apply Content Security Policy (CSP) headers limiting inline script execution and external script sources on the WordPress site.

# Verify plugin version and update via WP-CLI
wp plugin get smtp-amazon-ses --field=version
wp plugin update smtp-amazon-ses

# Search the database for suspicious stored payloads
wp db query "SELECT option_name, option_value FROM wp_options \
  WHERE option_value LIKE '%<script%' OR option_value LIKE '%onerror=%';"