CVE-2025-2325
📋 TL;DR
The WP Test Email plugin for WordPress has a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into email logs. These scripts execute when users view affected pages, potentially compromising their browsers. All WordPress sites using this plugin up to version 1.1.8 are affected.
💻 Affected Systems
- WP Test Email WordPress Plugin
📦 What is this software?
Wp Test Email by Boopathirajan
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, perform session hijacking, deface websites, or redirect users to malicious sites, potentially leading to complete site compromise.
Likely Case
Attackers inject malicious scripts that steal user session cookies or credentials, leading to account takeover and unauthorized access to the WordPress admin panel.
If Mitigated
With proper input validation and output escaping, the vulnerability is eliminated, preventing script injection entirely.
🎯 Exploit Status
Attackers can exploit this without authentication by submitting specially crafted email content that gets stored and executed when viewed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.1.9 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Test Email plugin. 4. Click 'Update Now' if available, or download version 1.1.9+ from WordPress repository. 5. Activate the updated plugin.
🔧 Temporary Workarounds
Disable WP Test Email Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate wp-test-email
🧯 If You Can't Patch
- Disable the WP Test Email plugin immediately
- Implement web application firewall rules to block XSS payloads in email content
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for WP Test Email version 1.1.8 or earlierCheck Version:
wp plugin get wp-test-email --field=versionVerify Fix Applied:
Verify WP Test Email plugin version is 1.1.9 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual email submissions with script tags or JavaScript code
- Multiple failed email test attempts with suspicious content
Network Indicators:
- HTTP requests containing script injection patterns in email parameters
- Unusual traffic to wp-test-email plugin endpoints
SIEM Query:
source="wordpress.log" AND "wp-test-email" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")