6.1

CVE-2023-5958

Exploit

POST SMTP Mailer < 2.7.1 - Unauthenticated Cross-site Scripting

POST SMTP Mailer <= 2.7.0 - Unauthenticated Stored Cross-Site Scripting

The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
Mögliche Gegenmaßnahme
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Update to version 2.7.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpexperts ≫ Post Smtp SwPlatformwordpress Version < 2.7.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
Version *-2.7.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.393
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://wpscan.com/vulnerability/22fa478d-e42e-488d-9b4b-a8720dec7cee
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/f25cd403-77a4-437b-b9ba-93137bf9c936
Third Party Advisory