CVE-2025-62912

9th percentile - higher than 9% of all known CVEs

The SiteGround Email Marketing plugin (versions up to 1.7.1) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability allows persistent injection of malicious JavaScript that executes in the user's browser.

An attacker can store a malicious script that executes for all users visiting the vulnerable page, potentially leading to theft of authentication data, redirections, or content modification. The risk is particularly significant for sites with a large user base.

Update the SiteGround Email Marketing plugin to the latest version (above 1.7.1) or remove it if not used. Regular scanning of the site for malicious code is also recommended.