CVE-2025-0521 is a stored cross-site scripting vulnerability (CWE-79) in the Post SMTP plugin for WordPress, affecting all versions up to and including 3.0.2. The flaw exists because the plugin does not properly sanitize or escape input in the 'from' and 'subject' parameters, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other client-side impacts. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction needed, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of users viewing affected pages, potentially compromising user confidentiality and integrity. There is no indication of availability impact. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the plugin vendor. Until a fix is available, consider disabling or restricting access to the plugin to mitigate risk.