CVE-2023-3135

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-313515.3Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integCVE-2023-313526.0A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private dCVE-2023-313556.0Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially alloCVE-2023-313564.4Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting inCVE-2023-313587.8A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting inCVE-2023-313597.8Incorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting inCVE-2023-31366.1The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.CVE-2023-313607.3Incorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability Service installation directory could allow aCVE-2023-313617.3A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve priviCVE-2023-313648.3Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to fCVE-2023-313653.9An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area resultCVE-2023-313665.5Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of