{"id":"CVE-2023-6621","aliases":["EUVD-2023-58844","GHSA-gr9g-7x3w-8vjj"],"status":"published","title":"Post SMTP \u003c 2.8.7 - Reflected Cross-Site Scripting","description":"The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00401,"percentile":0.34799,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-01-03T08:32:42Z","modified":"2026-10-28T02:31:14Z","products":[{"vendor":"saad iqbal","product":"post smtp"},{"vendor":"unknown","product":"post smtp"},{"vendor":"wpexperts","product":"post_smtp"}],"references":[{"url":"https://wpscan.com/vulnerability/b49ca336-5bc2-4d72-a9a5-b8c020057928","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6621","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gr9g-7x3w-8vjj"},{"url":"https://wordpress.org/plugins","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6621.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-6621","title":"Post SMTP \u003c 2.8.7 - Reflected Cross-Site Scripting","description":"The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.","status":"published","published":"2024-01-03T08:32:42.957Z","modified":"2025-06-18T15:36:31.33Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:25.095989Z"}],"euvd":[{"id":"EUVD-2023-58844","description":"The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.","status":"published","published":"2024-01-03T08:32:42Z","modified":"2025-06-18T15:36:31Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:20.01453Z"}],"ghsa":[{"id":"GHSA-gr9g-7x3w-8vjj","title":"The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before...","description":"The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.","status":"published","published":"2024-01-03T09:30:33Z","modified":"2024-01-18T05:06:54Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:55:26.812198Z"}],"nvd":[{"id":"CVE-2023-6621","description":"The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.","status":"published","published":"2024-01-03T09:15:11.44Z","modified":"2026-06-17T06:51:06.967Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:59.830468Z"}],"osv":[{"id":"CVE-2023-6621","title":"Post SMTP \u003c 2.8.7 - Reflected Cross-Site Scripting","description":"The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.","status":"published","published":"2024-01-03T08:32:42.957Z","modified":"2026-10-28T02:31:14.103134905Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:36.851042Z"}]}}