CVE-2025-58822 MEDIUM

CVE-2025-58822: WordPress WP Mail Plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability

Vendor Mndpsingh287
Product WP Mail
Weakness CWE-79 · XSS
Published September 5, 2025
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows DOM-Based XSS.This issue affects WP Mail: from n/a through <= 1.3.

Explanation of Vulnerability in Simple Terms

02Summary

WP Mail versions 1.3 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with low-level site access can craft a request that executes JavaScript in other users' browsers, potentially compromising their sessions or stealing sensitive data. The vulnerability requires user interaction and affects the integrity and confidentiality of the site.

What an attacker can do

03Attacker Capabilities

Inject JavaScript code that runs in other users' browsers, potentially stealing session tokens or sensitive information.

Potential impact on your site

04Site Impact

Authenticated users with low privileges can compromise other users' accounts or sessions through script injection attacks.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site and the victim must visit a page containing the malicious payload.

Key dates

06Disclosure timeline

September 5, 2025 CVE published
May 12, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57345 WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability CVE-2025-69156 WordPress Kids Zone - Children WordPress Theme theme <= 5.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-57366 WordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-57672 WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-57354 WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability