Wp Mail Logging
Monthly
Administrator-level users of the WP Mail Logging WordPress plugin, in all versions up to and including 1.17.0, can read complete mail-log rows belonging to other users - including recipient addresses, message subjects, full message bodies, and URLs contained in them. The flaw is that the 'email_address' parameter is passed unescaped into a SQL LIKE query during the WordPress personal-data export workflow, so an attacker with administrator privileges can retrieve additional records only when their own address contains a LIKE wildcard character (for example an underscore) that coincides with another address stored in the log. Exploitation is gated by several concrete preconditions - high privileges (CVSS PR:H), a wildcard-bearing attacker address, a matching entry in the mail log, and an administrator-triggered privacy export - and no public exploit identified at time of analysis; the assigned score is 2.7, reflecting a genuinely low-priority information-disclosure issue.
Stored HTML and CSS injection in the WP Mail Logging WordPress plugin before 1.17.0 lets unauthenticated users plant deceptive styled content and hyperlinks inside emails that the plugin records, because the plugin renders that email content in its admin log screens without properly restricting the HTML and CSS it contains. An attacker who can cause a logged email to be generated - for instance by submitting a public contact form - can deceive a logged-in administrator viewing the log into following a spoofed link that redirects the browser to an attacker-controlled page. The issue is rated CVSS v3.1 4.3 and publicly available exploit code exists, but it is not in CISA KEV and the impact is confined to content and link spoofing, with no confidentiality or availability loss and no confirmed script execution.
The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Administrator-level users of the WP Mail Logging WordPress plugin, in all versions up to and including 1.17.0, can read complete mail-log rows belonging to other users - including recipient addresses, message subjects, full message bodies, and URLs contained in them. The flaw is that the 'email_address' parameter is passed unescaped into a SQL LIKE query during the WordPress personal-data export workflow, so an attacker with administrator privileges can retrieve additional records only when their own address contains a LIKE wildcard character (for example an underscore) that coincides with another address stored in the log. Exploitation is gated by several concrete preconditions - high privileges (CVSS PR:H), a wildcard-bearing attacker address, a matching entry in the mail log, and an administrator-triggered privacy export - and no public exploit identified at time of analysis; the assigned score is 2.7, reflecting a genuinely low-priority information-disclosure issue.
Stored HTML and CSS injection in the WP Mail Logging WordPress plugin before 1.17.0 lets unauthenticated users plant deceptive styled content and hyperlinks inside emails that the plugin records, because the plugin renders that email content in its admin log screens without properly restricting the HTML and CSS it contains. An attacker who can cause a logged email to be generated - for instance by submitting a public contact form - can deceive a logged-in administrator viewing the log into following a spoofed link that redirects the browser to an attacker-controlled page. The issue is rated CVSS v3.1 4.3 and publicly available exploit code exists, but it is not in CISA KEV and the impact is confined to content and link spoofing, with no confidentiality or availability loss and no confirmed script execution.
The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.