CVE-2025-53454 describes a stored cross-site scripting vulnerability in the Ultimate WP Mail WordPress plugin by Rustaurius, affecting versions up to 1.3.8. The issue is caused by improper input neutralization during web page generation, which allows an attacker with low privileges and requiring user interaction to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS score of 6.5, reflecting medium severity with impacts on confidentiality, integrity, and availability. There is no indication of known exploits or available patches at this time.

An attacker with low privileges can inject malicious scripts that are stored and later executed in the context of other users who view the affected pages. This can lead to limited compromise of confidentiality, integrity, and availability of the affected system or user data. The vulnerability requires user interaction to be exploited and does not currently have known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with user inputs and consider restricting access to the affected plugin features. Monitor Rustaurius vendor communications for updates and apply patches promptly once released.