Analyst readout for executives and security teams
Plain-English summary
CVE-2025-0918 affects the WordPress SMTP for SendGrid - YaySMTP plugin through version 1.4. An unauthenticated attacker could place malicious script content into email logs, which may run when a site user views the affected log page. This creates administrative risk because the vulnerable area is likely viewed by trusted WordPress users.
Executive priority
Treat this as a high-priority WordPress plugin issue for sites using YaySMTP. The main business risk is script execution in trusted admin workflows, which can support account compromise or unauthorized site changes if an administrator views poisoned content.
Technical view
The issue is stored cross-site scripting, CWE-79, caused by insufficient input sanitization and output escaping in email log handling. The CVSS 3.1 score is 7.2 with network attack vector, low complexity, no privileges, and changed scope. The provided record cites affected versions up to and including 1.4.
Likely exposure
Exposure is limited to WordPress sites using SMTP for SendGrid - YaySMTP version 1.4 or earlier, especially where email logs are enabled or reviewed by administrators. The bundle does not identify other affected products.
Exploitation context
The CVE states unauthenticated attackers can inject scripts that execute when a user accesses an injected page. The bundle does not cite CISA KEV listing or active exploitation evidence, so active exploitation should not be assumed from these sources.
Researcher notes
Do not broaden affected scope beyond SMTP for SendGrid - YaySMTP <= 1.4 based on the provided bundle. The fix appears tied to WordPress plugin repository activity, but the bundle does not explicitly name a fixed version. Validate against vendor release notes before closing tickets.
Mitigation direction
- Inventory WordPress sites for SMTP for SendGrid - YaySMTP installations.
- Confirm whether installed versions are 1.4 or earlier.
- Check vendor and WordPress plugin guidance for a fixed release beyond 1.4.
- Temporarily disable the plugin if no fixed release is available.
- Restrict access to administrative log views where operationally possible.
- Review email logs for suspicious script-like content.
Validation and detection
- Check the installed plugin version in WordPress or asset inventory.
- Confirm whether email logging is enabled and who can view logs.
- Review Wordfence and WordPress plugin references for fix status.
- Inspect recent plugin changelog entries around changeset 3270556.
- Verify remediation by confirming the plugin is updated or disabled.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-0918 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N3.92.7WordfenceVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineWordfence
Discovered
- Source timelineWordfence
Vendor Notified
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b98f2a85-9535-4bf5-900c-f4f630c7b502?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/smtp-sendgrid/trunk/includes/Functions.phpCVE reference, Wordfence
- https://wordpress.org/plugins/smtp-sendgrid/#developersCVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset/3270556/CVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.