CVE-2025-12518

Vulnerability

Overview CVE-2025-12518 is a stored cross-site scripting (XSS) vulnerability in the Beefree SDK email builder. The flaw exists in the social media icon URL parameter, where user-supplied input is not properly sanitized before being stored. This allows an attacker to inject arbitrary HTML and JavaScript into an email template [2].

Exploitation

An attacker with the ability to create or modify an email template using the SDK can supply a malicious URL for a social media icon field. When a user previews the affected template, the injected script executes in the browser context of the preview page. While Beefree's Content Security Policy (CSP) may block some payloads, not all payloads are prevented, leaving the possibility of partial or full exploitation [2].

Impact

Successful exploitation could lead to account compromise, data theft, or further attacks against users who view the template preview. The vulnerability has been rated medium severity and was responsibly disclosed through CERT Polska [2].

Mitigation

The issue has been fixed in version 3.47.0 of the Beefree SDK. Users should update to this version or later to mitigate the risk. CERT Polska credits Michał Błaszczak for the report [2].