Reflected Cross-Site Scripting in POST SMTP Mailer Plugin for WordPress
CVE-2023-6629

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Post Smtp – Complete Email Deliverability And Smtp Solution With Email Logs, Alerts, Backup Smtp & Mobile App
Vendor
CVE Published:
3 January 2024

What is CVE-2023-6629?

A reflected cross-site scripting vulnerability exists in the POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP plugin for WordPress. This vulnerability arises from inadequate input sanitization and output escaping associated with the 'msg' parameter. Attackers can exploit this flaw to inject arbitrary web scripts into pages, which execute if an unsuspecting user is lured into clicking a malicious link. This poses significant security concerns for WordPress sites using this plugin, allowing unauthorized script execution without proper user authentication.

Affected Version(s)

Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 0 <= 2.8.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/post-smtp/trun...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matan Berson
.