Stored Cross-Site Scripting Vulnerability in Mail Control Plugin for WordPress
CVE-2023-3158

7.2HIGH

Key Information:

Vendor

Wordpress
Status
Mail Control – Email Customizer, Smtp Deliverability, Logging, Open And Click Tracking
Vendor
CVE Published:
12 July 2023

What is CVE-2023-3158?

The Mail Control plugin for WordPress introduces a vulnerability that allows attackers to exploit stored cross-site scripting due to inadequate input sanitization and output escaping. This security flaw affects versions up to and including 0.2.8, enabling unauthenticated users to inject malicious web scripts into email subjects. When the infected page is accessed by a user, these scripts execute, potentially compromising user data and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Mail Control – Email Customizer, SMTP Deliverability, logging, open and click Tracking * <= 0.2.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mail-control/t...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Thomas
JSON
.