WordPress Plugin Vulnerabilities

Vulnerability: SMTP for Amazon SES < 1.9 - Unauthenticated Stored Cross-Site Scripting via Email Logs

Description

The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
smtp-amazon-ses
Fixed in 1.9

References

CVE
CVE-2025-0957
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f6424fc9-f118-4654-89a7-1f7e6efa2c02

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Cristian Bejan (cbejan)
Verified
No
WPVDB ID
b3481881-cf6c-4bf2-bbf1-9ad42cd9b247

Timeline

Publicly Published
2025-02-22 (about 1 year ago)
Added
2025-02-22 (about 1 year ago)
Last Updated
2025-04-10 (about 1 year ago)

Other

Published
Title
Published
2025-05-29
Title
OpenSheetMusicDisplay < 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
Published
2026-04-07
Title
TableOn – WordPress Posts Table Filterable < 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
Published
2025-12-31
Title
Funnelforms Free <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2015-08-09
Title
Avenir-soft Direct Download <= 1.0 - Cross-Site Scripting (XSS) & CSRF
Published
2026-01-29
Title
B Slider < 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting