CVE-2025-0953 is a stored Cross-Site Scripting vulnerability (CWE-79) in the SMTP for Sendinblue – YaySMTP WordPress plugin, affecting versions up to and including 1.2. The vulnerability arises from insufficient sanitization of user input and inadequate output escaping, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users accessing the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users viewing the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed on behalf of the victim user. There is no indication of impact on availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Additionally, applying web application firewall (WAF) rules that detect and block XSS payloads may provide temporary mitigation.