CVE-2025-62912

The vulnerability is a Stored Cross-Site Scripting (XSS) in the SiteGround Email Marketing plugin for WordPress, versions 1.7.1 and earlier. It stems from improper neutralization of user input during web page generation, allowing attackers to store malicious scripts that execute when other users access the affected pages [1].

Exploitation requires a privileged user (e.g., administrator) to perform an action such as clicking a malicious link or submitting a crafted form, leading to script execution. This vulnerability is commonly used in mass-exploit campaigns targeting thousands of websites, regardless of their size or popularity [1].

A successful attack can inject malicious scripts, including redirects, advertisements, and arbitrary HTML payloads, compromising site integrity and potentially affecting visitors [1].

The vulnerability is resolved in version 1.7.2 of the plugin. Users are advised to update immediately. If unable to update, seeking assistance from a hosting provider or web developer is recommended. Patchstack users can enable auto-updates for vulnerable plugins [1].