{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-22802", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-01-07T21:05:34.184Z", "datePublished": "2025-01-09T15:39:20.648Z", "dateUpdated": "2026-04-28T16:11:07.549Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "yeemail", "product": "Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail", "vendor": "add-ons.org", "versions": [{"changes": [{"at": "2.1.5", "status": "unaffected"}], "lessThanOrEqual": "2.1.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "savphill | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:32:03.230Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail yeemail allows Stored XSS.<p>This issue affects Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail: from n/a through <= 2.1.4.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail yeemail allows Stored XSS.This issue affects Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail: from n/a through <= 2.1.4."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "Stored XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:11:07.549Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/yeemail/vulnerability/wordpress-email-templates-customizer-yeemail-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "title": "WordPress Email Templates Customizer YeeMail plugin <= 2.1.4 - Cross Site Scripting (XSS) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-10T20:18:28.977212Z", "id": "CVE-2025-22802", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T20:42:05.859Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-22802", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-01-07T21:05:34.184Z", "datePublished": "2025-01-09T15:39:20.648Z", "dateUpdated": "2025-01-10T20:42:05.859Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-01-09T15:39:20.648Z"}, "title": "WordPress Email Templates Customizer YeeMail plugin <= 2.1.4 - Cross Site Scripting (XSS) vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"vendor": "add-ons.org", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "yeemail", "product": "Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail", "versions": [{"lessThanOrEqual": "2.1.4", "status": "affected", "version": "n/a", "versionType": "custom", "changes": [{"at": "2.1.5", "status": "unaffected"}]}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail: from n/a through 2.1.4.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail allows Stored XSS.</p><p>This issue affects Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail: from n/a through 2.1.4.</p>"}]}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/yeemail/vulnerability/wordpress-email-templates-customizer-yeemail-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "baseSeverity": "MEDIUM", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "version": "3.1"}}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail wordpress plugin to the latest available version (at least 2.1.5)."}], "value": "Update the WordPress Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail wordpress plugin to the latest available version (at least 2.1.5)."}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "savphill (Patchstack Alliance)"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-22802", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-10T20:18:28.977212Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T20:18:30.421Z"}}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail yeemail allows Stored XSS.This issue affects Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail: from n/a through <= 2.1.4."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de p\u00e1ginas web ('Cross-site Scripting') en add-ons.org Email Templates Customizer para WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail permite XSS almacenado. Este problema afecta a Email Templates Customizer para WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail: desde n/a hasta 2.1.4."}], "id": "CVE-2025-22802", "lastModified": "2026-04-23T15:23:38.680", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 3.7, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2025-01-09T16:16:29.470", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/yeemail/vulnerability/wordpress-email-templates-customizer-yeemail-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}