CVE-2025-22802 (GCVE-0-2025-22802)

Vulnerability from cvelistv5 – Published: 2025-01-09 15:39 – Updated: 2025-01-10 20:42
VLAI?
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through 2.1.4.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail Affected: n/a , ≤ 2.1.4 (custom)
Create a notification for this product.
Credits
savphill (Patchstack Alliance)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22802",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-10T20:18:28.977212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-10T20:42:05.859Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "yeemail",
          "product": "Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail",
          "vendor": "add-ons.org",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.1.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.1.4",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "savphill (Patchstack Alliance)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in add-ons.org Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail allows Stored XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail: from n/a through 2.1.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in add-ons.org Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail: from n/a through 2.1.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-09T15:39:20.648Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/yeemail/vulnerability/wordpress-email-templates-customizer-yeemail-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail wordpress plugin to the latest available version (at least 2.1.5)."
            }
          ],
          "value": "Update the WordPress Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail wordpress plugin to the latest available version (at least 2.1.5)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Email Templates Customizer YeeMail plugin \u003c= 2.1.4 - Cross Site Scripting (XSS) vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-22802",
    "datePublished": "2025-01-09T15:39:20.648Z",
    "dateReserved": "2025-01-07T21:05:34.184Z",
    "dateUpdated": "2025-01-10T20:42:05.859Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in add-ons.org Email Templates Customizer for WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail: from n/a through 2.1.4.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de neutralizaci\\u00f3n incorrecta de la entrada durante la generaci\\u00f3n de p\\u00e1ginas web (\u0027Cross-site Scripting\u0027) en add-ons.org Email Templates Customizer para WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail permite XSS almacenado. Este problema afecta a Email Templates Customizer para WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail: desde n/a hasta 2.1.4.\"}]",
      "id": "CVE-2025-22802",
      "lastModified": "2025-01-09T16:16:29.470",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"audit@patchstack.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 3.7}]}",
      "published": "2025-01-09T16:16:29.470",
      "references": "[{\"url\": \"https://patchstack.com/database/wordpress/plugin/yeemail/vulnerability/wordpress-email-templates-customizer-yeemail-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve\", \"source\": \"audit@patchstack.com\"}]",
      "sourceIdentifier": "audit@patchstack.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"audit@patchstack.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22802\",\"sourceIdentifier\":\"audit@patchstack.com\",\"published\":\"2025-01-09T16:16:29.470\",\"lastModified\":\"2025-01-09T16:16:29.470\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in add-ons.org Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail: from n/a through 2.1.4.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de p\u00e1ginas web (\u0027Cross-site Scripting\u0027) en add-ons.org Email Templates Customizer para WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail permite XSS almacenado. Este problema afecta a Email Templates Customizer para WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail: desde n/a hasta 2.1.4.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"audit@patchstack.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":3.7}]},\"weaknesses\":[{\"source\":\"audit@patchstack.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://patchstack.com/database/wordpress/plugin/yeemail/vulnerability/wordpress-email-templates-customizer-yeemail-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve\",\"source\":\"audit@patchstack.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"21595511-bba5-4825-b968-b78d1f9984a3\", \"shortName\": \"Patchstack\", \"dateUpdated\": \"2025-01-09T15:39:20.648Z\"}, \"title\": \"WordPress Email Templates Customizer YeeMail plugin \u003c= 2.1.4 - Cross Site Scripting (XSS) vulnerability\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"impacts\": [{\"capecId\": \"CAPEC-592\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-592 Stored XSS\"}]}], \"affected\": [{\"vendor\": \"add-ons.org\", \"collectionURL\": \"https://wordpress.org/plugins\", \"defaultStatus\": \"unaffected\", \"packageName\": \"yeemail\", \"product\": \"Email Templates Customizer for WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail\", \"versions\": [{\"lessThanOrEqual\": \"2.1.4\", \"status\": \"affected\", \"version\": \"n/a\", \"versionType\": \"custom\", \"changes\": [{\"at\": \"2.1.5\", \"status\": \"unaffected\"}]}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in add-ons.org Email Templates Customizer for WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail: from n/a through 2.1.4.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in add-ons.org Email Templates Customizer for WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail allows Stored XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Email Templates Customizer for WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail: from n/a through 2.1.4.\u003c/p\u003e\"}]}], \"references\": [{\"tags\": [\"vdb-entry\"], \"url\": \"https://patchstack.com/database/wordpress/plugin/yeemail/vulnerability/wordpress-email-templates-customizer-yeemail-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve\"}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV3_1\": {\"baseScore\": 6.5, \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L\", \"baseSeverity\": \"MEDIUM\", \"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"LOW\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"scope\": \"CHANGED\", \"userInteraction\": \"REQUIRED\", \"version\": \"3.1\"}}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Update the WordPress Email Templates Customizer for WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail wordpress plugin to the latest available version (at least 2.1.5).\"}], \"value\": \"Update the WordPress Email Templates Customizer for WordPress \\u2013 Drag And Drop Email Templates Builder \\u2013 YeeMail wordpress plugin to the latest available version (at least 2.1.5).\"}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"savphill (Patchstack Alliance)\"}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-22802\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-10T20:18:28.977212Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-10T20:18:30.421Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-22802\", \"assignerOrgId\": \"21595511-bba5-4825-b968-b78d1f9984a3\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Patchstack\", \"dateReserved\": \"2025-01-07T21:05:34.184Z\", \"datePublished\": \"2025-01-09T15:39:20.648Z\", \"dateUpdated\": \"2025-01-10T20:42:05.859Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.