Stored Cross-Site Scripting Vulnerability in Post SMTP Plugin for WordPress
CVE-2023-3082
7.2HIGH
Key Information:
- Vendor
- WordPress
- Vendor
- CVE Published:
- 12 July 2023
Summary
The Post SMTP plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input validation and output encoding. This vulnerability allows unauthenticated attackers to embed malicious scripts within email content, which can be executed when other users view an affected page. As a result, it poses a significant risk to users by compromising their session, potentially revealing sensitive data or allowing for further exploitation of the site.
Affected Version(s)
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress * <= 2.5.7
References
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Alex Thomas