Stored XSS in FluentSMTP WordPress Plugin via Email Logs

The FluentSMTP plugin for WordPress, specifically versions up to and including 2.2.95, contains a stored cross-site scripting (XSS) vulnerability. The issue stems from insufficient input sanitization and output escaping of the 'to.name' parameter when processing email logs through wp_mail() calls. Unauthenticated attackers can inject arbitrary web scripts into these logs, which are subsequently rendered in the WordPress administrative interface.

Crucially, while the primary list view of email logs utilizes an escapeHtml pipeline to prevent script execution, the detail view accessed via 'Prev' or 'Next' navigation controls fails to apply this security control. When an administrator navigates through email details, the injected payload triggers, allowing for arbitrary JavaScript execution in the context of the administrator's browser session. This vulnerability poses a significant risk to WordPress site integrity by enabling session hijacking or unauthorized administrative actions.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript within the administrative session of a WordPress site. This can lead to account takeover, the creation of rogue administrator accounts, or unauthorized modifications to site content or settings. Given the ubiquity of WordPress and the function of SMTP plugins, a large number of installations are potentially susceptible if they remain unpatched.

Recommendation

• Update the FluentSMTP plugin to the latest version available beyond 2.2.95 to remediate the sanitization flaw.
• Monitor administrative access logs for unusual login patterns or the creation of new user accounts shortly after potential XSS trigger events.
• Audit WordPress logs for suspicious input contained within the 'to.name' fields of email logging tables.
• Deploy a Web Application Firewall (WAF) to detect and block common XSS payloads in request parameters.