CVE-2025-1123 Overview
CVE-2025-1123 is a Stored Cross-Site Scripting (XSS) vulnerability in the Solid Mail – SMTP email and logging plugin for WordPress, developed by SolidWP. The flaw affects all versions up to and including 2.1.5. The plugin fails to properly sanitize input and escape output for the email Name, Subject, and Body fields. Unauthenticated attackers can inject arbitrary JavaScript that executes when administrators or users view the logged email entries in the WordPress dashboard. The vulnerability is tracked under CWE-79 and is exploitable over the network without user interaction.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript into the email log, leading to session theft, administrative account takeover, and arbitrary actions performed in the context of an authenticated WordPress administrator.
Affected Products
- Solid Mail – SMTP email and logging plugin for WordPress (all versions ≤ 2.1.5)
- WordPress sites with SolidWP Solid Mail installed and email logging enabled
- Administrator dashboards that render logged email records
Discovery Timeline
- 2025-05-23 - CVE-2025-1123 published to the National Vulnerability Database (NVD)
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-1123
Vulnerability Analysis
The Solid Mail plugin captures outgoing email metadata and content for later review through an administrative log interface. The plugin stores the sender Name, email Subject, and message Body without applying sufficient input sanitization on write or output escaping on read. An attacker who triggers an outbound email from the WordPress site, for example through a password reset form, contact form, or registration flow, can supply HTML and JavaScript payloads in any of these fields. The malicious content is persisted in the database and later rendered inside the administrator-facing email log view.
When an authenticated administrator browses the log, the injected script executes in the browser within the privileged WordPress session. This permits theft of authentication cookies, creation of new administrator accounts via the REST API, plugin or theme modification, and pivot to full site compromise. Because the attack vector is network-based and requires no privileges or user interaction beyond the victim viewing the log, exploitation is straightforward against any vulnerable installation. The EPSS score of 0.635% reflects current exploitation likelihood, though stored XSS in widely deployed WordPress plugins is routinely weaponized in opportunistic scanning campaigns.
Root Cause
The root cause is missing or inadequate sanitization functions on the input path and missing escaping functions on the output path. WordPress provides helpers such as sanitize_text_field(), wp_kses(), and esc_html() for these purposes. The plugin's logging routines did not consistently apply them to the Name, Subject, and Body fields prior to storage and rendering.
Attack Vector
An unauthenticated attacker submits a crafted payload through any site feature that generates a logged email. The payload is stored in the plugin's email log table. When a privileged user views the log entry in wp-admin, the browser parses and executes the injected script in the administrator security context.
No verified public proof-of-concept code is available. The fix applied by the vendor can be reviewed in the WordPress Plugin Change Log and the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-1123
Indicators of Compromise
- Email log entries containing <script>, onerror=, onload=, javascript:, or encoded variants in the Name, Subject, or Body columns
- Unexpected new administrator accounts in wp_users or unsolicited role changes in wp_usermeta
- Outbound HTTP requests from administrator browsers to unknown external domains immediately after viewing the Solid Mail log
- Modifications to plugin or theme files with timestamps correlating to administrator dashboard sessions
Detection Strategies
- Query the Solid Mail log database table for HTML tag patterns and JavaScript event handlers in stored fields
- Inspect WordPress access logs for POST requests to public endpoints (registration, password reset, contact forms) containing script payloads in sender fields
- Monitor wp-admin sessions for anomalous REST API calls to /wp-json/wp/v2/users originating from administrator browsers
Monitoring Recommendations
- Enable WordPress audit logging to capture user creation, role changes, and plugin file modifications
- Deploy a Web Application Firewall (WAF) with rules that block script tags and event handlers in form submissions targeting the affected site
- Alert on outbound connections from administrator workstations to newly registered or low-reputation domains following dashboard activity
How to Mitigate CVE-2025-1123
Immediate Actions Required
- Update the Solid Mail – SMTP email and logging plugin to a version later than 2.1.5 that includes the fix from changeset 3283671
- Audit the plugin's email log table and purge entries containing HTML or JavaScript payloads
- Review WordPress user accounts and remove any unauthorized administrators created since the plugin was installed
- Rotate administrator passwords and invalidate active sessions through wp_logout_url() enforcement or session token reset
Patch Information
The vendor addressed the vulnerability in the Solid Mail plugin via commit changeset 3283671. Site operators should upgrade through the WordPress plugin updater or by replacing the plugin directory with the latest release. Additional advisory details are available in the Wordfence Vulnerability Report.
Workarounds
- Disable the Solid Mail plugin until patching is possible if the site cannot be updated immediately
- Temporarily disable email logging in the plugin settings to prevent attacker-controlled content from reaching the database
- Restrict access to wp-admin by IP allowlist so only trusted operators can view potentially poisoned log entries
- Deploy WAF rules that strip or block <script> and event handler attributes from public form submissions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
