CVE-2025-23598

Summary

CVE-2025-23598 is a Cross-site Scripting (XSS) vulnerability affecting Recip.ly, a web-based email service. The issue stems from the improper neutralization of user input during web page generation. An attacker can exploit this vulnerability by injecting malicious scripts into emails, which may then be reflected in the web interface when users view those emails. Successful exploitation could allow an attacker to steal user session cookies, leading to unauthorized account access. This vulnerability affects all versions of Recip.ly from n/a through 1.1.8.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.