PT-2019-8534
CVE-2017-18603
·
Published
2019-09-10
·
Updated
2019-09-12
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
postman-smtp plugin through 2017-10-04 for WordPress
Description
The issue concerns a cross-site scripting (XSS) problem. It is exploited via the
page parameter in the "wp-admin/tools.php" page, specifically when accessing the postman email log.Recommendations
For the postman-smtp plugin through 2017-10-04, consider disabling access to the wp-admin/tools.php?page=postman email log page until a fix is available. Restrict the use of the
page parameter in this context to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾