CVE-2023-0219

FluentSMTP < 2.2.3 - Stored XSS via Email Logs

The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.

Affected

FluentSMTP

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.51% chance of exploitation in the next 30 days, 42nd percentile

Published

2023-03-13

Updated

2025-02-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/71662b72-311c-42db-86c5-a0276d25535c

References

• CVE Record
• NVD entry