CVE-2025-0953

Summary

CVE-2025-0953 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the SMTP for Sendinblue plugin, specifically versions up to 1.1.1 of the YaySMTP variant used in WordPress installations. This issue arises due to inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject malicious web scripts into pages. Successful exploitation of this vulnerability allows the attacker to execute arbitrary scripts whenever a user accesses an injected page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.