CVE-2023-1090

CVSS V2 None CVSS V3 None

Description

The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Overview

CVE ID
CVE-2023-1090

Assigner
contact@wpscan.com

Vulnerability Status
Received

Published Version
2023-05-02T08:15:09

Last Modified Date
2023-05-02T08:15:09

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

References

Reference URL	Reference Tags
https://github.com/youki992/youki992.github.io/blob/master/others/apply.md
https://wpscan.com/vulnerability/d470dd6c-dcac-4a3e-b42a-2489a31aca45

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-1090
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1090

History

Created	Old Value	New Value	Data Type	Notes
2023-05-02 09:00:57				Added to TrackCVE
2023-05-02 09:01:00			Weakness Enumeration	new