Medium severity · published Apr 22, 2026
CVE-2018-25269
ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
ICEWARP 10.3.4 and 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
ICEWARP Client · icewarp
10.3.4; 11.0.0.0 · source: vendor
IC
Icewarp · Icewarp
11.0.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25269
Product
http://www.icewarp.com/
Exploit
https://www.exploit-db.com/exploits/45974
Third Party Advisory
https://www.vulncheck.com/advisories/icewarp-cross-site-scripting-via-email-html-injection