Stored Cross-Site Scripting in YaySMTP Plugin for WordPress
CVE-2023-3093

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
YaySMTP – Simple WP SMTP Mail
Vendor
CVE Published:
12 July 2023

Summary

The YaySMTP plugin for WordPress has a vulnerability that allows stored cross-site scripting due to inadequate input validation and output escaping. Unauthenticated attackers can leverage this flaw to inject arbitrary web scripts into email content, which will be executed on pages accessed by users. This poses a significant security risk for sites utilizing affected versions of the plugin, where malicious scripts could potentially compromise user sessions or redirect users to harmful sites.

Affected Version(s)

YaySMTP – Simple WP SMTP Mail 2.4.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/2922163/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Thomas
.