Stored Cross-Site Scripting Vulnerability in Post SMTP Plugin for WordPress
CVE-2023-3082
6.1MEDIUM
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 12 July 2023
Summary
The Post SMTP plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input validation and output encoding. This vulnerability allows unauthenticated attackers to embed malicious scripts within email content, which can be executed when other users view an affected page. As a result, it poses a significant risk to users by compromising their session, potentially revealing sensitive data or allowing for further exploitation of the site.
Affected Version(s)
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress * <= 2.5.7
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Alex Thomas