CVE-2023-3721

Summary

CVE-2023-3721 is a vulnerability affecting the WP-EMail WordPress plugin before version 2.69.1. This issue allows high privilege users, including admins, to execute Stored Cross-Site Scripting (XSS) attacks, bypassing the unfiltered_html capability restriction in multisite setups. The plugin fails to sanitize and escape certain settings, making them susceptible to malicious code injection. This vulnerability poses a significant security risk, potentially leading to unauthorized access or data theft. Users are advised to update to the latest version of the WP-EMail plugin to mitigate this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.