Stored Cross-Site Scripting Vulnerability in Mail Control Plugin for WordPress
CVE-2023-3158
7.2HIGH
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 12 July 2023
What is CVE-2023-3158?
The Mail Control plugin for WordPress introduces a vulnerability that allows attackers to exploit stored cross-site scripting due to inadequate input sanitization and output escaping. This security flaw affects versions up to and including 0.2.8, enabling unauthenticated users to inject malicious web scripts into email subjects. When the infected page is accessed by a user, these scripts execute, potentially compromising user data and site integrity.
Affected Version(s)
Mail Control – Email Customizer, SMTP Deliverability, logging, open and click Tracking * <= 0.2.8