POST SMTP Mailer < 2.7.1 - Unauthenticated Cross-site Scripting
CVE-2023-5958

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
POST SMTP Mailer
Vendor
CVE Published:
27 November 2023

Summary

The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.

Affected Version(s)

POST SMTP Mailer 0 < 2.7.1

References

https://wpscan.com/vulnerability/22fa478d-e42e-488d-9b4b-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcin Węgłowski (AFINE Team)
WPScan
.