Vulnerability · Published Mar 13, 2023 · Assigned by WPScan
CVE-2023-0219FluentSMTP < 2.2.3 - Stored XSS via Email Logs
Medium 5.4
In plain English
A medium-severity security flaw in FluentSMTP from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)0.5%top 56.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | FluentSMTP | 0 – before 2.2.3 |
References
- https://wpscan.com/vulnerability/71662b72-311c-42db-86c5-a0276d25535c exploit, vdb-entry, technical-description