PT-2023-16092 · WordPress · Fluentsmtp

Vaibhav Rajput · Published 2023-03-13 · Updated 2023-03-16 · CVE-2023-0219

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FluentSMTP WordPress plugin versions prior to 2.2.3

Description The issue arises from the plugin's failure to sanitize or escape email content, making it susceptible to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires the presence of other plugins that enable users to send emails with unfiltered HTML.

Recommendations For versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. As a temporary workaround, consider disabling the viewing of email logs until a patch is applied. Restrict access to the email logs to minimize the risk of exploitation. Avoid using plugins that enable users to send emails with unfiltered HTML in the affected versions until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-0219

Affected Products

Fluentsmtp

References · 5

• 🔥 https://wpscan.com/vulnerability/71662b72-311c-42db-86c5-a0276d25535c · Exploit
• https://osv.dev/vulnerability/CVE-2023-0219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0219 · Security Note
• https://t.me/cvenotify/46341 · Telegram Post
• https://t.me/cibsecurity/59921 · Telegram Post