CVE-2025-1319

Summary

CVE-2025-1319 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Site Mailer plugin for WordPress, versions up to and including 1.2.3. Attackers can exploit this vulnerability by injecting malicious scripts into the plugin, which are then stored and executed whenever a user accesses an injected page. This can potentially allow unauthenticated attackers to gain control over users' sessions or steal sensitive information. The root cause of the issue is insufficient input sanitization and output escaping in the plugin. Users are advised to update to the latest version or deactivate and remove the vulnerable plugin to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.