cve/2023/CVE-2023-5958.md

### [CVE-2023-5958](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5958)
![](https://img.shields.io/static/v1?label=Product&message=POST%20SMTP%20Mailer&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%202.7.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brighgreen)

### Description

The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.

### POC

#### Reference
- https://wpscan.com/vulnerability/22fa478d-e42e-488d-9b4b-a8720dec7cee

#### Github
- https://github.com/afine-com/research
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00			`### [CVE-2023-5958](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5958)`
			`![](https://img.shields.io/static/v1?label=Product&message=POST%20SMTP%20Mailer&color=blue)`
			`![](https://img.shields.io/static/v1?label=Version&message=0%3C%202.7.1%20&color=brighgreen)`
			`![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brighgreen)`

			`### Description`

			`The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.`

			`### POC`

			`#### Reference`
Update CVE sources 2024-05-28 08:49 2024-05-28 08:49:17 +00:00			`- https://wpscan.com/vulnerability/22fa478d-e42e-488d-9b4b-a8720dec7cee`
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00
			`#### Github`
			`- https://github.com/afine-com/research`