Stored Cross-Site Scripting in POST SMTP Mailer Plugin for WordPress
CVE-2023-7027
7.2HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 3 January 2024
What is CVE-2023-7027?
The POST SMTP Mailer plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'device' header. This issue arises from inadequate input sanitization and output escaping, allowing attackers to inject arbitrary web scripts. These scripts can execute whenever a user accesses a page where the malicious input has been injected, potentially compromising user security and integrity.
Affected Version(s)
POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications * <= 2.8.7