The Solid Mail – SMTP email and logging plugin for WordPress by SolidWP suffers from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2025-1123. This vulnerability arises from improper neutralization of input during web page generation, specifically in the email Name, Subject, and Body fields. Because these inputs are not properly sanitized or escaped, an unauthenticated attacker can inject malicious scripts that persist and execute in the context of users viewing the affected pages. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change. The vulnerability affects all versions up to 2.1.5. No patch or vendor advisory is currently available.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary scripts in the context of users accessing the affected pages, potentially leading to theft of sensitive information or unauthorized actions performed on behalf of the user. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected plugin to reduce exposure. Monitor official SolidWP channels for updates and apply patches promptly once available.