CVE-2025-23453: Stars SMTP Mailer XSS Vulnerability

CVE-2025-23453 Overview

CVE-2025-23453 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the Myriad Solutionz Stars SMTP Mailer plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when visited by an authenticated user, execute arbitrary JavaScript in the victim's browser session. The vulnerability affects all versions of stars-smtp-mailer up to and including 1.7. Exploitation requires user interaction but no authentication, and the scope change indicates impact beyond the vulnerable component.

Critical Impact
Successful exploitation allows attackers to execute arbitrary scripts in administrator browsers, potentially leading to session theft, plugin manipulation, or pivoting to broader WordPress compromise.

Affected Products

Myriad Solutionz Stars SMTP Mailer plugin for WordPress
All versions from n/a through 1.7
WordPress installations using the stars-smtp-mailer plugin

Discovery Timeline

2025-01-16 - CVE-2025-23453 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23453

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) flaw in the Stars SMTP Mailer WordPress plugin. The plugin fails to properly sanitize and encode user-controllable input before reflecting it back in HTTP responses. An attacker can embed malicious JavaScript payloads in request parameters that the plugin renders directly into the generated HTML output.

Reflected XSS requires a victim to interact with an attacker-crafted link or form submission. Once triggered, the injected script executes in the security context of the WordPress site origin. This enables theft of authentication cookies, manipulation of the DOM, forced administrative actions, and exfiltration of sensitive data from administrative interfaces.

The CWE classification [CWE-79] confirms the root cause is missing or insufficient output encoding. The EPSS score is 0.232% with a percentile of 45.9, reflecting moderate likelihood of opportunistic exploitation against unpatched WordPress installations.

Root Cause

The plugin processes HTTP request parameters and outputs them in administrative or front-end pages without applying contextual output encoding such as esc_html(), esc_attr(), or wp_kses(). WordPress provides these sanitization functions specifically to prevent XSS, but the plugin code path bypasses them. Any string containing HTML or JavaScript metacharacters is rendered as active markup.

Attack Vector

An attacker delivers a crafted URL containing the XSS payload to an authenticated WordPress user, typically through phishing email, social media, or a malicious referrer. When the user clicks the link, the browser sends the payload to the vulnerable plugin endpoint. The plugin reflects the payload into the response, and the browser executes it within the WordPress site's origin context.

The vulnerability mechanism is described in the Patchstack WordPress Vulnerability Report. No public proof-of-concept code is available in the referenced advisory.

Detection Methods for CVE-2025-23453

Indicators of Compromise

HTTP requests to stars-smtp-mailer plugin endpoints containing URL-encoded <script>, javascript:, or onerror= payloads
Web server access logs showing unusually long query strings or fragments referencing the plugin path
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting a WordPress admin page
Creation of new administrator accounts or modification of plugin settings without corresponding legitimate admin sessions

Detection Strategies

Inspect web application firewall (WAF) logs for reflected XSS signatures targeting WordPress plugin parameters
Monitor WordPress audit logs for administrative actions originating from sessions that recently followed external referrers
Deploy content security policy (CSP) violation reporting to surface inline script execution attempts
Correlate browser process telemetry with web traffic to identify script-driven credential or cookie exfiltration

Monitoring Recommendations

Alert on HTTP GET or POST requests to /wp-content/plugins/stars-smtp-mailer/ containing HTML metacharacters in parameters
Track plugin version inventory across WordPress fleet to flag installations of stars-smtp-mailer version 1.7 or earlier
Review referrer headers on administrative requests for external domains preceding sensitive actions

How to Mitigate CVE-2025-23453

Immediate Actions Required

Identify all WordPress sites running the Stars SMTP Mailer plugin and confirm installed version
Deactivate and remove the stars-smtp-mailer plugin if a patched version is not available
Invalidate active administrator sessions and rotate credentials for any account that may have accessed crafted URLs
Apply WAF rules blocking reflected XSS patterns targeting the plugin endpoints

Patch Information

No fixed version is referenced in the advisory at the time of publication. The vulnerability affects all versions through 1.7. Site administrators should monitor the Patchstack advisory and the WordPress plugin repository for an updated release from Myriad Solutionz.

Workarounds

Remove or deactivate the Stars SMTP Mailer plugin until a vendor patch is available
Replace the plugin with an alternative SMTP mailer that receives active security maintenance
Enforce a strict Content Security Policy that disallows inline scripts to reduce XSS impact
Require administrators to use isolated browser profiles when managing WordPress to limit cookie exposure

bash

# Configuration example: identify vulnerable plugin installations via WP-CLI
wp plugin list --name=stars-smtp-mailer --field=version
wp plugin deactivate stars-smtp-mailer
wp plugin delete stars-smtp-mailer