WordPress Zoho ZeptoMail 插件 <= 3.3.1 - 跨站请求伪造 (CSRF) 导致存储型跨站脚本 (Stored XSS) 漏洞

The XSS vulnerability in Zoho ZeptoMail allows an attacker to inject arbitrary JavaScript code into the application. This code can then be executed in the context of a victim's browser when they visit a crafted URL. Successful exploitation could lead to session hijacking, account takeover, defacement of the ZeptoMail interface, or the theft of sensitive information such as email content and credentials. The 'Stored XSS' nature of the vulnerability means the malicious script persists on the server, making it a persistent threat to all users who interact with the affected functionality.

Organizations utilizing Zoho ZeptoMail, particularly those with sensitive email data or critical business processes reliant on the platform, are at risk. Shared hosting environments where multiple users share the same ZeptoMail instance are especially vulnerable, as an attacker compromising one user's account could potentially gain access to others.

• wordpress / composer / npm:

grep -r 'transmail' /var/www/html/zeptomail/plugins/

• generic web:

curl -I https://your-zeptomail-domain.com/transmail?script=<script>alert(1)</script>

1. 2025-12-31Disclosure

   disclosure

1. 已保留2025-05-30
2. 发布日期2025-12-31
3. 修改日期2026-04-28
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-49028 is to immediately upgrade Zoho ZeptoMail to version 3.3.2 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to filter out suspicious input in the transmail functionality. Carefully review and sanitize all user-supplied input before rendering it in the ZeptoMail interface. Monitor ZeptoMail logs for unusual activity or suspicious script injections. After upgrade, confirm the vulnerability is resolved by attempting to inject a simple XSS payload through the transmail feature and verifying it is not executed.

活跃安装数

5K小众

插件评分

5.0

需要WordPress版本

4.8+

兼容至

6.8.5

需要PHP版本

5.6+