CVE-2025-0953 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2025-0953?

CVE-2025-0953 has a CVSS score of 7.2 (HIGH). This vulnerability allows unauthenticated attackers to inject malicious scripts into WordPress pages using the SMTP for Sendinblue – YaySMTP plugin, which execute when users visit those pages. It affects WordPress sites with the plugin installed in vulnerable versions, potentially compromising user sessions or site integrity.

📋 TL;DR

This vulnerability allows unauthenticated attackers to inject malicious scripts into WordPress pages using the SMTP for Sendinblue – YaySMTP plugin, which execute when users visit those pages. It affects WordPress sites with the plugin installed in vulnerable versions, potentially compromising user sessions or site integrity.

💻 Affected Systems

Products:

SMTP for Sendinblue – YaySMTP WordPress plugin

Versions: Up to and including version 1.1.1

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with the vulnerable plugin version are affected, regardless of configuration settings.

📦 What is this software?

Yaysmtp by Yaycommerce

View all CVEs affecting Yaysmtp →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal session cookies, redirect users to malicious sites, or deface the website, leading to data breaches or reputational damage.

🟠

Likely Case

Attackers inject scripts to steal user credentials or perform phishing attacks, impacting site visitors and potentially administrators.

🟢

If Mitigated

With proper input sanitization and output escaping, the risk is minimized, but outdated versions remain vulnerable until patched.

🌐 Internet-Facing: HIGH, as the plugin is used on public WordPress sites, making them directly accessible to unauthenticated attackers over the internet.

🏢 Internal Only: LOW, as the vulnerability requires web access to the WordPress site, which is typically internet-facing; internal-only deployments are rare for this plugin.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation is straightforward due to unauthenticated access and common XSS techniques, but no public proof-of-concept has been disclosed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 1.1.2 or later

Vendor Advisory: https://wordpress.org/plugins/smtp-sendinblue/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin dashboard. 2. Navigate to Plugins > Installed Plugins. 3. Find 'SMTP for Sendinblue – YaySMTP' and click 'Update Now' if available. 4. Alternatively, download the latest version from the WordPress plugin repository and upload it manually.

🔧 Temporary Workarounds

Disable the plugin temporarily

WordPress

Deactivate the vulnerable plugin to prevent exploitation until a patch can be applied.

wp plugin deactivate smtp-sendinblue

🧯 If You Can't Patch

Implement a web application firewall (WAF) to block XSS payloads targeting the plugin endpoints.
Restrict access to the WordPress admin and affected pages to trusted IP addresses only.

🔍 How to Verify

Check if Vulnerable:

Check the plugin version in WordPress admin under Plugins > Installed Plugins; if version is 1.1.1 or lower, it is vulnerable.

Check Version:

wp plugin get smtp-sendinblue --field=version

Verify Fix Applied:

After updating, confirm the plugin version is 1.1.2 or higher in the same location.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to plugin-specific endpoints with script tags or JavaScript payloads in parameters.

Network Indicators:

HTTP traffic containing malicious script injections targeting the plugin's functions.

SIEM Query:

source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php" OR uri_path CONTAINS "smtp-sendinblue") AND (http_method="POST" AND (request_body CONTAINS "<script>" OR request_body CONTAINS "javascript:"))

📊 Metadata

CVE ID: CVE-2025-0953

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.85% exploit probability (74.4th percentile)

Published: February 22, 2025

Last Updated: March 5, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-0953, you might also want to check these: