WordPress Plugin Vulnerabilities

Post SMTP < 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Email Contents

Description

The plugin does not sufficiently sanitize and escape email contents, which could lead to unauthenticated users injecting arbitrary web scripts that execute whenever a page is accessed.

Affects Plugins

Plugin icon
post-smtp
Fixed in 2.5.8

References

CVE
CVE-2023-3082
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6ecd0fa6-4fdb-4780-9560-0bb126800685

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Alex Thomas
Verified
No
WPVDB ID
f2f07c8a-4ff0-4caa-b699-1377fcd9d23c

Timeline

Publicly Published
2023-07-11 (about 2 years ago)
Added
2023-07-12 (about 2 years ago)
Last Updated
2023-07-12 (about 2 years ago)

Other

Published
Title
Published
2025-07-18
Title
OpenStreetMap for Gutenberg and WPBakery Page Builder <= 1.2.0 - Contributor+ Stored XSS
Published
2021-09-29
Title
WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting
Published
2025-09-15
Title
Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments
Published
2024-12-05
Title
Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-09-23
Title
AnWP Football Leagues < 0.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload