CVE-2023-0219

The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.51% chance of exploitation in the next 30 days, 41th percentile

Published

2023-03-13

Updated

2025-02-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/71662b72-311c-42db-86c5-a0276d25535c

References

• CVE Record
• NVD entry

Related

• CVE-2023-0214
• CVE-2023-0220
• CVE-2023-0212
• CVE-2023-0224
• CVE-2023-0210
• CVE-2023-0227