Reflected Cross-Site Scripting in POST SMTP Mailer Plugin for WordPress
CVE-2023-6629

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications
Vendor
CVE Published:
3 January 2024

Summary

A reflected cross-site scripting vulnerability exists in the POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP plugin for WordPress. This vulnerability arises from inadequate input sanitization and output escaping associated with the 'msg' parameter. Attackers can exploit this flaw to inject arbitrary web scripts into pages, which execute if an unsuspecting user is lured into clicking a malicious link. This poses significant security concerns for WordPress sites using this plugin, allowing unauthorized script execution without proper user authentication.

Affected Version(s)

POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications * <= 2.8.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/post-smtp/trun...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matan Berson
.