CVE-2023-3082

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-3082

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3082.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-3082

Published

2023-07-12T04:38:45.662Z

Modified

2026-07-08T06:28:51.545424215Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email

Details

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3082.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "Wordfence",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "2.5.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/wpexpertsio/post-smtp

Affected ranges

Type

GIT

Repo

https://github.com/wpexpertsio/post-smtp

Events

Introduced

Fixed

320e8a9f75a0c3ce374a6e2997f3a77ee548806a

Database specific

{
    "cpe": "cpe:2.3:a:wpexperts:post_smtp:*:*:*:*:*:wordpress:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.8"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

2.*

2.0.1

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.0.18

2.0.19

2.0.2

2.0.20

2.0.21

2.0.22

2.0.23

2.0.24

2.0.25

2.0.25-beta.1

2.0.26

2.0.27

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.1

2.1-beta.1

2.1.1

2.1.1.1

2.1.2

2.1.2-beta-1

2.1.2-rc.1

2.1.2-rc.2

2.1.4

2.1.4-beta.1

2.1.4-rc.1

2.1.4-rc.2

2.1.6

2.1.7

2.1.8

2.2

2.2-beta.2

2.2.1

2.3

2.3.1

2.4

2.4-beta.1

2.4.1

2.4.2

2.4.2-beta.2

2.4.3

2.5-beta.1

2.5-rc.1

2.5-rc.2

2.5-rc.3

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

v.*

v.1.9.0

v.1.9.1

v.1.9.2

v1.*

v1.9.3

v1.9.4

v1.9.5

v1.9.6

v1.9.7

v1.9.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3082.json"