CVE-2025-0916

Summary

CVE-2025-0916 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the YaySMTP and Email Logs plugin for WordPress, versions 2.4.9 to 2.6.2. Attackers can exploit this weakness by injecting malicious scripts into web pages, which execute when users access the injected pages. Unauthenticated attackers can take advantage of this vulnerability, which arises due to insufficient input sanitization and output escaping. Notably, the issue was initially patched in version 2.4.8 but was reintroduced in version 2.4.9 upon the removal of the wp_kses_post() WordPress sanitization function.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.