CVE-2023-5958

Published Nov 27, 2023

Last updated a year ago

CVSS medium 6.1

Overview

Description: The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
Source: contact@wpscan.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:wpexperts:post_smtp_mailer:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E40A03E0-E94A-431E-8C67-039F96A535BE",
            "versionEndExcluding": "2.7.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References