Medium severity6.5NVD Advisory· Published Mar 13, 2025· Updated Jun 17, 2026

CVE-2025-25363

Description

An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc allows attackers with Administrator privileges to execute arbitrary Javascript in context of a user's browser via injecting a crafted payload into the HTML field of a template.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Thepluginpeople/Enterprise Mail Handler
cpe:2.3:a:thepluginpeople:enterprise_mail_handler:*:*:*:*:*:jira:*:*
Range: >=4.1.53-dc,<4.1.69-dc
The Plugin People/Enterprise Mail Handler for Jira Data Center (JEMH)cpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <4.1.69-dc

Patches

Vulnerability mechanics

References

github.com/florkie/CVE/blob/main/CVE-2025-25363.mdnvdThird Party Advisory
marketplace.atlassian.com/apps/4832/enterprise-mail-handler-for-jira-jemh/version-historynvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000