CVE-2023-0219

FluentSMTP < 2.2.3 - Stored XSS via Email Logs

published March 13, 2023

CVSS
—
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Published
2023-03-13T16:03Z
EPSS history
Timeline
  • 13 MAR 16:03Z
    FluentSMTP < 2.2.3 - Stored XSS via Email Logs
    cvelistv5