7.2 High

CVE-2023-3088 The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up…

Description

The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product	Affected versions	Fixed in
WP Mail Log 1.1	earliest → 1.1.1	No fix stated
WP Mail Log 1.1	earliest → 1.1.1	No fix stated

Do you use WP Mail Log?

Track this CVE Watch WP Mail Log Check my SBOMs

www.cveye.io/en/cve/CVE-2023-3088

Timeline

Published July 12, 2023
Last modified April 8, 2026

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE