CVE-2025-1319: Elementor Site Mailer XSS Vulnerability

CVE-2025-1319 Overview

CVE-2025-1319 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Site Mailer plugin for WordPress. The plugin, developed by Elementor, provides SMTP replacement, email API deliverability, and email logging features. All versions up to and including 1.2.3 fail to properly sanitize user input and escape output. Unauthenticated attackers can inject arbitrary JavaScript that executes when any user views an affected page. The vulnerability requires user interaction and impacts confidentiality and integrity within the victim's browser context.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads into WordPress pages, enabling session hijacking, credential theft, and administrative account takeover when logged-in users view the injected content.

Affected Products

Elementor Site Mailer plugin for WordPress (versions ≤ 1.2.3)
WordPress installations using Site Mailer for SMTP replacement
WordPress installations using Site Mailer for email logging and API deliverability

Discovery Timeline

2025-02-28 - CVE-2025-1319 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1319

Vulnerability Analysis

The Site Mailer plugin logs email-related data and renders it in WordPress administrative and user-facing views. The plugin fails to sanitize input on write operations and does not escape output on render. This combination allows an attacker to place JavaScript payloads into stored fields that later execute in a victim's browser. The scope change (S:C) indicates the injected script executes in a security context different from the vulnerable component, which is typical when payloads render inside privileged WordPress dashboard views.

Root Cause

The root cause is insufficient input sanitization combined with missing output escaping in the plugin's rendering code paths. WordPress provides escaping helpers such as esc_html(), esc_attr(), and wp_kses_post(), along with sanitization helpers like sanitize_text_field(). The affected versions do not consistently apply these helpers to attacker-controlled data before storage and rendering.

Attack Vector

The attack vector is network-based and requires no authentication or privileges. An unauthenticated attacker submits a crafted request containing script payloads to a plugin endpoint that persists the data. When an administrator or other user later views the page rendering that data, the browser executes the injected script. Successful exploitation can steal session cookies, perform actions as the logged-in user, deface content, or redirect users to attacker-controlled infrastructure.

No public proof-of-concept has been published. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-1319

Indicators of Compromise

Unexpected <script>, onerror=, onload=, or javascript: strings stored in Site Mailer email log tables within the WordPress database
Outbound requests from administrator browsers to unfamiliar domains immediately after loading Site Mailer admin pages
New or modified WordPress administrator accounts created shortly after Site Mailer pages were accessed
Anomalous POST requests to Site Mailer plugin endpoints from unauthenticated sources

Detection Strategies

Query the WordPress database for stored records containing HTML event handlers or <script tags in Site Mailer log tables
Review web server access logs for POST requests to /wp-content/plugins/site-mailer/ endpoints originating from unauthenticated sessions
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions inside wp-admin
Correlate administrator session activity with unexpected AJAX or fetch calls to external domains

Monitoring Recommendations

Alert on creation of new WordPress users with administrator role outside change windows
Monitor plugin file integrity and flag unauthorized modifications to wp-config.php or theme files
Track HTTP requests containing common XSS payload patterns targeting plugin endpoints
Baseline outbound network connections from browsers used for WordPress administration

How to Mitigate CVE-2025-1319

Immediate Actions Required

Update the Site Mailer plugin to a version later than 1.2.3 as soon as a fixed release is available from the WordPress plugin repository
Audit Site Mailer email log entries for stored script payloads and purge malicious records
Rotate credentials and session tokens for all WordPress administrators who accessed Site Mailer pages while the vulnerability was present
Review the WordPress user table for unauthorized accounts and remove any that were not provisioned by an administrator

Patch Information

The vendor addressed the vulnerability in a plugin update tracked in WordPress Plugin Changeset 3247059. Administrators should upgrade to the patched release through the WordPress admin dashboard or by replacing plugin files from the official Site Mailer plugin page.

Workarounds

Deactivate and remove the Site Mailer plugin until an upgrade to a patched version is completed
Restrict access to /wp-admin/ and plugin endpoints using a web application firewall rule that blocks common XSS payload patterns
Enforce a strict Content Security Policy that disallows inline scripts within the WordPress admin interface
Limit which users can view Site Mailer logs by enforcing least-privilege role assignments

bash

# Update the Site Mailer plugin via WP-CLI once a patched version is published
wp plugin update site-mailer

# Verify the installed version is greater than 1.2.3
wp plugin get site-mailer --field=version

# Temporary containment: deactivate the plugin if a patch is not yet available
wp plugin deactivate site-mailer