Stored Cross-Site Scripting Vulnerability in Mail Control Plugin for WordPress
CVE-2023-3158

7.2HIGH

Key Information:

Vendor
Wordpress
Status
Mail Control – Email Customizer, Smtp Deliverability, Logging, Open And Click Tracking
Vendor
CVE Published:
12 July 2023

Summary

The Mail Control plugin for WordPress introduces a vulnerability that allows attackers to exploit stored cross-site scripting due to inadequate input sanitization and output escaping. This security flaw affects versions up to and including 0.2.8, enabling unauthenticated users to inject malicious web scripts into email subjects. When the infected page is accessed by a user, these scripts execute, potentially compromising user data and site integrity.

Affected Version(s)

Mail Control – Email Customizer, SMTP Deliverability, logging, open and click Tracking * <= 0.2.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mail-control/t...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Thomas
.