CVE-2023-3092 in SMTP Mail Plugin
Summary
by MITRE • 07/12/2023
The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2023-3092 affects the SMTP Mail plugin for WordPress, a widely used component that facilitates email delivery functionality for WordPress websites. This plugin version 1.3.46 and earlier contains a critical stored cross-site scripting flaw that arises from inadequate input sanitization and output escaping mechanisms. The vulnerability specifically manifests when the 'Save Data SendMail' feature is enabled, creating a persistent security risk that can be exploited by unauthenticated attackers without requiring any special privileges or credentials to compromise affected systems.
The technical implementation of this vulnerability stems from the plugin's failure to properly sanitize user input when processing email subjects within the SendMail functionality. When an attacker crafts a malicious email subject containing script code and submits it through the plugin's interface, the system stores this input without adequate sanitization measures. The stored data is then later retrieved and displayed in the user interface without proper output escaping, creating an ideal environment for cross-site scripting attacks. This stored nature of the vulnerability means that the malicious payload persists in the database and executes every time a user views the affected content, making it particularly dangerous for administrators and other users who may access the email records.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with the capability to perform various malicious activities including session hijacking, credential theft, and redirection to malicious websites. The unauthenticated nature of the attack means that any user with access to the affected WordPress site can potentially exploit this vulnerability without requiring authentication. Attackers can craft payloads that target administrators who may view email logs or records, potentially leading to complete compromise of the WordPress installation. This vulnerability aligns with CWE-79, which describes cross-site scripting flaws, and represents a significant risk to web application security, particularly in environments where WordPress plugins handle user input and display it in web pages.
Organizations affected by this vulnerability should immediately update to the latest version of the SMTP Mail plugin where the issue has been resolved through proper input sanitization and output escaping mechanisms. The recommended mitigation strategy includes implementing comprehensive input validation that strips or encodes potentially dangerous characters and ensuring that all output is properly escaped before display. Additionally, administrators should consider implementing web application firewalls and monitoring for suspicious email subject patterns that may indicate attempted exploitation. This vulnerability demonstrates the critical importance of proper security practices in plugin development and highlights the need for regular security audits of third-party WordPress components to prevent similar issues from compromising web applications. The ATT&CK framework categorizes this vulnerability under the technique of web application attacks, specifically targeting the execution of malicious code through input validation flaws that persist in web applications.