CVE-2023-3092

🗓️ 12 Jul 2023 04:38:47Reported by WordfenceType

The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.2.16 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2023-3092	12 Jul 202312:41	–	circl
CNNVD	WordPress Plugin SMTP Mail 跨站脚本漏洞	12 Jul 202300:00	–	cnnvd
Cvelist	CVE-2023-3092 SMTP Mail <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting via Email Subject	12 Jul 202304:38	–	cvelist
EUVD	EUVD-2023-43780	3 Oct 202520:07	–	euvd
NVD	CVE-2023-3092	12 Jul 202305:15	–	nvd
OSV	CVE-2023-3092	12 Jul 202305:15	–	osv
Patchstack	WordPress SMTP Mail Plugin <= 1.3.36 is vulnerable to Cross Site Scripting (XSS)	6 Jul 202300:00	–	patchstack
Prion	Cross site scripting	12 Jul 202305:15	–	prion
Positive Technologies	PT-2023-23050 · WordPress · Smtp Mail	12 Jul 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-3092	23 May 202504:34	–	redhatcve

NVD

Vulners

Node

photoboxone smtp_mailRange≤1.2.16wordpress

[
  {
    "vendor": "photoboxone",
    "product": "SMTP Mail",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.3.46",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/smtp-mail/tags/1.3.42/includes/data-list-table.php
plugins	www.plugins.trac.wordpress.org/browser/smtp-mail/tags/1.3.43/includes/data-list-table.php
plugins	www.plugins.trac.wordpress.org/browser/smtp-mail/trunk/includes/data-list-table.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/8ae734d1-0cd4-4ff5-8448-828b0fb64f70

08 Apr 2026 18:18Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.16.1 - 7.2

EPSS0.03385

SSVC

CWE-79