Stored Cross-Site Scripting in POST SMTP Mailer Plugin for WordPress
CVE-2023-7027

5.4MEDIUM

Key Information:

Vendor: Wordpress
Status: POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications
Vendor: CVE Published:; 3 January 2024

Summary

The POST SMTP Mailer plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'device' header. This issue arises from inadequate input sanitization and output escaping, allowing attackers to inject arbitrary web scripts. These scripts can execute whenever a user accesses a page where the malicious input has been injected, potentially compromising user security and integrity.

Affected Version(s)

POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications * <= 2.8.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/post-smtp/trun...

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Jan 3, 2024
Vulnerability Reserved
Dec 20, 2023

Credit

Sean Murphy