CVE-2023-3080 in WP Mail Catcher Plugin
Summary
by MITRE • 07/12/2023
The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The WP Mail Catcher plugin for WordPress represents a significant security vulnerability through its susceptibility to stored cross-site scripting attacks, as documented in CVE-2023-3080. This vulnerability affects versions up to and including 2.1.2, creating a persistent threat vector that can compromise user sessions and execute malicious code within the context of the affected WordPress installation. The flaw specifically manifests when email subjects containing malicious scripts are stored within the plugin's database and subsequently displayed to users without proper sanitization or escaping mechanisms.
The technical implementation of this vulnerability stems from inadequate input validation and output escaping practices within the plugin's codebase. When email subjects are processed and stored, the plugin fails to properly sanitize user-supplied input before persisting it to the database. This insufficient sanitization creates a condition where attackers can inject malicious JavaScript code into email subject fields that are then stored and later retrieved when administrators or users view email records within the plugin interface. The vulnerability is classified as stored XSS because the malicious payload is permanently stored within the application's database rather than being executed through a single request.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with a persistent means of compromising user sessions and potentially escalating privileges within the WordPress environment. Unauthenticated attackers can exploit this weakness to inject scripts that may steal cookies, session tokens, or other sensitive information from users who access the affected plugin interface. The attack vector is particularly concerning because it requires no authentication to deliver the initial payload, making it accessible to anyone who can submit email data to the vulnerable plugin. This vulnerability directly aligns with CWE-79 which describes improper neutralization of input during web page generation in web applications, and represents a classic stored XSS scenario that can be leveraged for session hijacking, credential theft, and further exploitation of the WordPress installation.
Mitigation strategies for this vulnerability should prioritize immediate plugin updates to versions that address the sanitization and escaping deficiencies. System administrators should implement comprehensive input validation at multiple layers including database storage, API endpoints, and user interface rendering to prevent malicious content from being persisted. Additionally, network-based security controls such as web application firewalls should be configured to monitor for suspicious script patterns in email subject fields and other user input areas. The ATT&CK framework categorizes this vulnerability under T1059.007 for scripting and T1566.001 for spearphishing attachments, indicating that this vulnerability can be exploited as part of broader attack chains targeting WordPress environments. Organizations should also consider implementing content security policies and regular security audits of third-party plugins to prevent similar vulnerabilities from being introduced into their WordPress installations.