Fluentsmtp Wp Smtp Plugin With Amazon Ses Sendgrid Mailgun Postmark Cloudflare Tosend Gmail And Any Smtp
Monthly
Stored XSS in FluentSMTP (WordPress plugin) versions up to and including 2.2.95 allows unauthenticated attackers to persist malicious scripts inside the plugin's Email Log detail view by controlling the recipient display name (to.name) field in any wp_mail() invocation. The payload bypasses the escapeHtml sanitization applied by the log list view and fires exclusively in the detail view when an administrator uses the Prev/Next navigation controls, meaning the attack surface is narrower than the CVSS UI:N vector implies. No public exploit code or CISA KEV listing has been identified; a patched version (2.3.0) is confirmed available via the WordPress plugin repository.
Stored XSS in FluentSMTP (WordPress plugin) versions up to and including 2.2.95 allows unauthenticated attackers to persist malicious scripts inside the plugin's Email Log detail view by controlling the recipient display name (to.name) field in any wp_mail() invocation. The payload bypasses the escapeHtml sanitization applied by the log list view and fires exclusively in the detail view when an administrator uses the Prev/Next navigation controls, meaning the attack surface is narrower than the CVSS UI:N vector implies. No public exploit code or CISA KEV listing has been identified; a patched version (2.3.0) is confirmed available via the WordPress plugin repository.