CVE-2025-23453

CVE-2025-23453 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Stars SMTP Mailer WordPress plugin by Myriad Solutionz. The issue affects all versions of Stars SMTP Mailer from unknown initial release through version 1.7 inclusive. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers with no required privileges can exploit this vulnerability remotely over the network with low attack complexity, though it requires user interaction, such as tricking a victim into accessing a maliciously crafted link or input reflected in the web page. Successful exploitation enables limited impacts on confidentiality, integrity, and availability (low in each), but the changed scope (S:C) allows consequences to extend beyond the vulnerable component, potentially affecting higher-privilege assets like administrative sessions via session hijacking or script execution in the victim's browser.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/stars-smtp-mailer/vulnerability/wordpress-stars-smtp-mailer-plugin-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the reflected XSS in the Stars SMTP Mailer WordPress plugin up to version 1.7, recommending updates to patched versions where available or alternative mitigations like input sanitization for affected sites.