Unknown Post Smtp Mailer vulnerabilities

CVE-2023-3178 [MEDIUM] CWE-352 CVE-2023-3178: The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX act The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack.

CVE-2023-6620 [HIGH] CWE-89 CVE-2023-6620: The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several par The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin.

CVE-2023-5958 [MEDIUM] CWE-79 CVE-2023-5958: The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before disp The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.

CVE-2023-3179 [HIGH] CWE-352 CVE-2023-3179: The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX act The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an a