CVE-2023-3082

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2023-3082 Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

WordPress Post SMTP Plugin <= 2.5.7 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.5.7 Fixed in 2.5.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3082 Patch priority Low CVSS severity Low 7.1 Developer WPExperts PSID c8d98d03e5dd Credits Alex Thomas Required privilege...

WordPress Post SMTP Plugin < 2.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Post SMTP Type Plugin Vulnerable versions 2.5.7 Fixed in 2.5.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3179 Patch priority Low CVSS severity Low 8.8 Developer WPExperts PSID a42127c2ce5a Credits Erwan LR WPScan Required privilege...

CVE-2019-25145

The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2019-25145

CVE-2019-25145 concerns the WordPress plugin “Contact Form & SMTP Plugin by PirateForms.” The vulnerability affects public/class-pirateforms-public.php up to version 2.5.1 and stems from insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary...

CVE-2019-25145 Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection

The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress Plugin Contact Form & SMTP Plugin by PirateForms 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-11372 · Pirateforms · Contact Form & Smtp Plugin

Name of the Vulnerable Software and Affected Versions: Contact Form & SMTP Plugin by PirateForms versions up to, and including, 2.5.1 Description: The issue arises from insufficient input sanitization and output escaping in the 'public/class-pirateforms-public.php' file, allowing unauthenticated...

CVE-2022-42699 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)

Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin = 1.5.1 on WordPress...

PT-2022-21773 · WordPress · Easy Wp Smtp

Name of the Vulnerable Software and Affected Versions: Easy WP SMTP WordPress plugin versions prior to 1.5.0 Description: The issue arises from the unserialization of the content of an imported file, potentially leading to a PHP object injection issue. This can occur when an admin imports a...

CVE-2022-2352 Post SMTP < 2.1.7 - Admin+ Blind SSRF

The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example...

NocoDB information disclosure vulnerability

In NocoDB prior to 0.91.7, the SMTP plugin doesn't have verification or validation. This allows attackers to make requests to internal servers and read the contents...

CVE-2022-1612

The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

PT-2022-14828 · Nocodb · Nocodb

Name of the Vulnerable Software and Affected Versions: NocoDB versions prior to 0.91.7 Description: The issue concerns the generation of error messages containing sensitive information and the lack of verification or validation in the SMTP plugin. This allows attackers to make requests to interna...

SSRF via Plugin SMTP

Description The SMTP plugin doesn't have verification or validation, allowing the attacker to make requests to internal servers and get the contents. Reproduce 1. Go to Team & Settings 2. App Store SMTP 3. Configure and intercept Test request 4. Change Host/Port to internal address, example:...

WordPress postman-smtp plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. postman-smtp is an email plugin used in it. A cross-site scripting vulnerability exists in the WordPress postman-smtp plugin. An...

WordPress bws-smtp plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. bws-smtp is a plugin used in it to configure an SMTP server to receive e-mail. A cross-site scripting vulnerability exists ...

Cross site scripting

The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues...

CVE-2017-18518

The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues...