CVE-2025-31029

Name of the Vulnerable Software and Affected Versions replyMail versions prior to 1.2.1

Description The plugin contains a Stored Cross-site Scripting (XSS) flaw, which occurs when an application includes untrusted data in a web page without proper validation or encoding. Additionally, the software is susceptible to Cross-Site Request Forgery (CSRF), a flaw that allows unauthenticated attackers to perform unauthorized actions by tricking a site administrator into clicking a malicious link. This CSRF issue is caused by missing or incorrect nonce validation within a function.

Recommendations Update to a version later than 1.2.0.