Stored Cross-Site Scripting Vulnerability in WP Mail Logging for WordPress
CVE-2023-3081

7.2HIGH

Key Information:

Vendor
WordPress
Status
WP Mail Logging
Vendor
CVE Published:
12 July 2023

Summary

The WP Mail Logging plugin for WordPress is susceptible to a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping mechanisms. This flaw allows unauthenticated attackers to inject arbitrary web scripts into email contents. These scripts could execute on impacted pages, potentially compromising user security when accessed. A partial fix was introduced in version 1.11.1, yet systems using prior versions remain exposed to such attacks.

Affected Version(s)

WP Mail Logging * <= 1.11.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/2923464/wp-m...
https://plugins.trac.wordpress.org/changeset/2925728/wp-m...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Thomas
.