CVE-2025-2325 is a stored cross-site scripting vulnerability in the WP Test Email plugin for WordPress, affecting all versions up to 1.1.8. The issue arises from insufficient neutralization of input during web page generation, specifically in the Email Logs functionality. This flaw allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users accessing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS score of 7.2 with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact. No known exploits in the wild have been reported, and no vendor patch or advisory is currently provided.

Successful exploitation enables unauthenticated attackers to execute arbitrary scripts in the browsers of users who access the compromised Email Logs pages. This can lead to information disclosure and integrity violations such as session hijacking or unauthorized actions performed on behalf of the user. There is no reported impact on system availability. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the Email Logs pages to trusted users only and avoid exposing these pages publicly. Monitoring for suspicious activity related to the plugin is advisable. Do not rely on generic mitigations; await vendor guidance or updates.