FluentSMTP < 2.0.1 - Authenticated Stored XSS
CVE-2021-24528

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Fluentsmtp – WordPress Mail Smtp, Ses, Sendgrid, Mailgun And Any Smtp Plugin
Vendor
CVE Published:
30 August 2021

Summary

The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.

Affected Version(s)

FluentSMTP – WordPress Mail SMTP, SES, SendGrid, Mailgun and Any SMTP Plugin 2.0.1

References

https://wpscan.com/vulnerability/8b8d316b-96b2-4cdc-9da5-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

YoshiKen
.