Security readout for executives and security teams
Plain-English summary
A WordPress email plugin can store attacker-supplied script in its email logs. When an administrator or other authorized user views the affected log page, that script may run in their browser. This can threaten admin sessions and site integrity, but the provided sources do not show active exploitation.
Executive priority
Prioritize remediation this week for internet-facing WordPress sites, especially where administrators regularly review email logs. The issue is high severity because unauthenticated input can become stored script, but current sources do not justify emergency active-exploitation language.
Technical view
CVE-2025-0957 is stored XSS in SMTP for Amazon SES - YaySMTP, attributed to insufficient input sanitization and output escaping in email log handling. The CVSS 3.1 score is 7.2. Source version evidence is inconsistent: the title says <= 1.8, while the description says up to and including 1.7.1.
Likely exposure
Exposure is likely limited to WordPress sites running SMTP for Amazon SES - YaySMTP with email logging enabled or accessible. Treat versions through 1.8 as suspect until verified against vendor or WordPress plugin release notes because the supplied sources conflict on affected versions.
Exploitation context
The source bundle supports unauthenticated stored XSS, but not known active exploitation. The bundled KEV flag is false. Practical impact depends on whether attacker-controlled email content reaches plugin logs and whether a privileged user later views the affected page.
Researcher notes
Evidence is sufficient for CWE-79 stored XSS and high CVSS, but version scope is unclear. The supplied title and description disagree on whether 1.8 is affected. Avoid asserting exploitation in the wild unless a KEV entry or cited intelligence source later supports it.
Mitigation direction
- Inventory WordPress sites using SMTP for Amazon SES - YaySMTP.
- Update the plugin following WordPress.org or vendor release guidance.
- Review plugin changelog and changeset 3270161 for the security fix.
- Restrict administrative access to WordPress dashboards.
- Temporarily disable or limit email log viewing if update timing is uncertain.
Validation and detection
- Check installed YaySMTP plugin versions across WordPress sites.
- Confirm whether email logging is enabled and who can view logs.
- Verify the installed code includes changeset 3270161 or a later fix.
- Review recent WordPress admin activity for unusual behavior after log viewing.
- Monitor vendor, Wordfence, and CVE records for version clarification.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-0957 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N3.92.7WordfenceVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineWordfence
Discovered
- Source timelineWordfence
Vendor Notified
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f6424fc9-f118-4654-89a7-1f7e6efa2c02?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/smtp-amazon-ses/trunk/includes/Functions.phpCVE reference, Wordfence
- https://wordpress.org/plugins/smtp-amazon-ses/#developersCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/smtp-amazon-ses/trunk/includes/Helper/Utils.phpCVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset/3270161/CVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.