6.1

CVE-2023-5958

Exploit

POST SMTP Mailer <= 2.7.0 - Unauthenticated Stored Cross-Site Scripting

The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
Mögliche Gegenmaßnahme
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App: Update to version 2.7.1, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App
Version * - 2.7.0
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpexperts ≫ Post Smtp SwPlatformwordpress Version < 2.7.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.78% 0.729
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.