CVE-2023-3092

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-309205.5In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privCVE-2023-309215.5In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privCVE-2023-309225.5In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privCVE-2023-309235.5In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privCVE-2023-309245.5In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privCVE-2023-309255.5In opm service, there is a missing permission check. This could lead to local information disclosure with no additional execution privilegesCVE-2023-309265.5In opm service, there is a missing permission check. This could lead to local information disclosure with no additional execution privilegesCVE-2023-309275.5In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privCVE-2023-309287.8In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execCVE-2023-309297.8In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execCVE-2023-30936.1The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 dueCVE-2023-309305.5In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution priv
CVE-2023-3092: Medium severity, CVSS 6.1 | Vulnix