Stored Cross-Site Scripting Vulnerability in FluentSMTP Plugin for WordPress
CVE-2023-3087

7.2HIGH

Key Information:

Vendor

WordPress
Status
Fluentsmtp – WP Mail Smtp, Amazon Ses, Sendgrid, Mailgun And Any Smtp Connector Plugin
Vendor
CVE Published:
12 July 2023

What is CVE-2023-3087?

The FluentSMTP plugin for WordPress exhibits a vulnerability that allows stored cross-site scripting due to inadequate input sanitization and output escaping. This issue can be exploited by unauthenticated attackers to inject malicious web scripts into email subjects. When users access the affected pages, these scripts execute, potentially compromising website integrity and user data.

Affected Version(s)

FluentSMTP – WP Mail SMTP, Amazon SES, SendGrid, MailGun and Any SMTP Connector Plugin * <= 2.2.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/2935217/flue...
https://plugins.trac.wordpress.org/changeset/2935217/flue...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Thomas
.
CVE-2023-3087 : Stored Cross-Site Scripting Vulnerability in FluentSMTP Plugin for WordPress