Mail Logging Catcher
Monthly
Stored cross-site scripting in the Mail logging - WP Mail Catcher WordPress plugin (all versions up to and including 2.1.12) allows unauthenticated attackers to inject arbitrary web scripts that execute when a privileged user opens the plugin's mail log view in wp-admin. Exploitation is not possible against a default standalone install: it requires a separately installed plugin such as Contact Form 7 that passes unauthenticated user-controlled input into WordPress mail fields, plus a failed outgoing mail that causes PHPMailer to generate a 'wp_mail_failed' error message embedding the attacker's input. No public exploit identified at time of analysis; risk is conditional and mid-tier per independent assessment (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
Stored cross-site scripting in the Mail logging - WP Mail Catcher WordPress plugin (all versions up to and including 2.1.12) allows unauthenticated attackers to inject arbitrary web scripts that execute when a privileged user opens the plugin's mail log view in wp-admin. Exploitation is not possible against a default standalone install: it requires a separately installed plugin such as Contact Form 7 that passes unauthenticated user-controlled input into WordPress mail fields, plus a failed outgoing mail that causes PHPMailer to generate a 'wp_mail_failed' error message embedding the attacker's input. No public exploit identified at time of analysis; risk is conditional and mid-tier per independent assessment (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).