VulnerabilityModified
CVE-2023-5958
The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
MEDIUM 6.1EPSS 0.51%
Does this matter?
Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.
Description
The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.51% probability · 42th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- wpexperts/post smtp
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/22fa478d-e42e-488d-9b4b-a8720dec7ceeExploit, Third Party Advisory
- https://wpscan.com/vulnerability/22fa478d-e42e-488d-9b4b-a8720dec7ceeExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.