Stored Cross-Site Scripting Vulnerability in FluentSMTP Plugin for WordPress
CVE-2023-3087

7.2HIGH

Key Information:

Vendor: WordPress
Status: Fluentsmtp – WP Mail Smtp, Amazon Ses, Sendgrid, Mailgun And Any Smtp Connector Plugin
Vendor: CVE Published:; 12 July 2023

Summary

The FluentSMTP plugin for WordPress exhibits a vulnerability that allows stored cross-site scripting due to inadequate input sanitization and output escaping. This issue can be exploited by unauthenticated attackers to inject malicious web scripts into email subjects. When users access the affected pages, these scripts execute, potentially compromising website integrity and user data.

Affected Version(s)

FluentSMTP – WP Mail SMTP, Amazon SES, SendGrid, MailGun and Any SMTP Connector Plugin * <= 2.2.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/changeset/2935217/flue...

CVSS V3.1

Score:

7.2

Severity:

HIGH

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published
Jul 12, 2023
Vulnerability Reserved
Jun 3, 2023

Credit

Alex Thomas