FluentSMTP < 2.2.3 - Stored XSS via Email Logs

2023-02-2000:00:00

Vaibhav Rajput

fluentsmtp

stored xss

email logs

wordpress

subscribe2 plugin

custom smtp

mailtrap

author+ role

preview icon

0.001 Low

EPSS

Percentile

23.3%

JSON

The plugin does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.

XSS Payload : <img src=x onerror=alert('xss') >

Steps to reproduce:
1. Install subscribe2 plugin (https://wordpress.org/plugins/subscribe2/)
2. Install FluentSMTP
3. Configure FluentSMTP to use custom SMTP (for testing use mailtrap).
4. As another user (needs Author+ role), send an email using subscribe2 plugin with email content as xss payload.
5. View logs and click on preview icon to trigger XSS.

0.001 Low

EPSS

Percentile

23.3%

JSON

Related for WPEX-ID:71662B72-311C-42DB-86C5-A0276D25535C