WordPress Plugin Vulnerabilities

POST SMTP Mailer < 2.8.8 - Unauthenticated Stored Cross-Site Scripting via device

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the ‘device’ header due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
post-smtp
Fixed in 2.8.8

References

CVE
CVE-2023-7027
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8911a3-ce0f-420c-bf2a-1c2929d01cef

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Sean Murphy
Verified
No
WPVDB ID
bbaea07a-f96c-48d2-86e5-1ddd6cbed183

Timeline

Publicly Published
2024-01-02 (about 2 years ago)
Added
2024-01-03 (about 2 years ago)
Last Updated
2024-01-03 (about 2 years ago)

Other

Published
Title
Published
2025-05-07
Title
Simple Blog Stats < 20250423 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2014-08-01
Title
AVChat Video Chat 1.4.1 - index_popup.php Multiple Parameters Reflected XSS
Published
2025-01-14
Title
Solidres <= 0.9.4 - Reflected XSS
Published
2025-12-30
Title
Team Showcase < 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-02-20
Title
WordPress Custom Settings <= 1.0 - Admin+ Stored XSS