FluentSMTP < 2.2.3 – Stored XSS via Email Logs | CVE 2023-0219 | Plugin Vulnerabilities

Description

The plugin does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.

Proof of Concept

XSS Payload : <img src=x onerror=alert('xss') >

Steps to reproduce:
1. Install subscribe2 plugin (https://wordpress.org/plugins/subscribe2/)
2. Install FluentSMTP
3. Configure FluentSMTP to use custom SMTP (for testing use mailtrap).
4. As another user (needs Author+ role), send an email using subscribe2 plugin with email content as xss payload.
5. View logs and click on preview icon to trigger XSS.

Affects Plugins

Fixed in 2.2.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Vaibhav Rajput

Submitter

Vaibhav Rajput

Verified

Yes

WPVDB ID

71662b72-311c-42db-86c5-a0276d25535c

Timeline

Publicly Published

2023-02-20 (about 2 years ago)

Added

2023-02-20 (about 2 years ago)

Last Updated

2023-02-20 (about 2 years ago)

Other

Published

Title

Published

2025-02-18

Title

XV Random Quotes <= 2.6.0 - Settings Reset via CSRF

Published

2021-06-16

Title

WP Reset < 1.90 - Authenticated Stored XSS

Published

2014-08-01

Title

WooCommerce SagePay Direct Payment Gateway 0.1.6.6 - pages/3DCallBack.php Multiple Parameter Reflected XSS

Published

2025-10-08

Title

WSAnalytics <= 1.1.2 - Reflected Cross-Site Scripting

Published

2025-01-16

Title

Bit.ly linker <= 1.1 - Reflected Cross-Site Scripting