Postman SMTP Mailer/Email Log is prone to a cross-site scripting vulnerability

  • WordPress Plugin Postman SMTP Mailer/Email Log is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. WordPress Plugin Postman SMTP Mailer/Email Log version 1.7.2 is vulnerable; prior versions may also be affected.

    Edit the source code to ensure that input is properly sanitised or disable the plugin until a fix is available.

Viewing 8 replies - 31 through 38 (of 38 total)

  • Thanks guys!
    Maybe put a note at the new plugin installation page at the repo?

    @steveb123 did you also DELETE Postman after deactivating it? settings were still there?

    @john,

    Yes I deleted it with no issues. Just in case it was a fluke, you could always copy and paste the Postman settings to Notepad or similar, there are so few as a back up.

    But again I had no issues

    Great idea, many thanks! (I forgot about those…)

    First, many thanks and blessings to:
    – Jason Hendriks @jasonhendriks for the massive effort expended to create the original version of this uber-cool plugin.
    – Yehuda Hassine @yehudah for the heroic efforts he has made to not only fix the critical bugs, but to have it reinstated to the WP plugin repository. You sir are a champion of the WordPress community.
    – @diegocanal and many others for your posts, testing, feedback, etc. in support of this accomplishment. You are exemplars all, truly. I salute you and am supremely grateful!

    My install of Post SMTP Mailer/Email Log plugin was trouble-free. I simply:
    – as a safeguard, recorded the original Postman SMTP plugin settings and took a snapshot of the email log. (turns out this backup step wasn’t necessary in my case)
    – disabled the original plugin.
    – installed and activated this one via the plugins page in the dashboard.
    – verified the settings and email log from the original plugin were intact.
    – Deleted the original plugin via the plugins page in the dashboard.
    – Made a few test comments in a blog post to confirm email notifications.

    No problems, everything works as expected! 5 stars!!! Woohoo! ??

    • This reply was modified 7 years, 1 month ago by Bodhi.
    • This reply was modified 7 years, 1 month ago by Bodhi.
    • This reply was modified 7 years, 1 month ago by Bodhi.

    @bodhi – thanks for the simple, clear instructions. Your comment answered all my questions.

    Would be great if you (or someone else) could add these instructions via a Pull Request to the plugins Readme.txt.

    Hey @bodhirayo,
    Thank you so much for the clear instructions!
    The update to the new plugin worked like a charm for me ??
    Much appreciated!
    LL

    @leopard-lady, you are welcome! glad to hear your upgrade was trouble-free! ??

Viewing 8 replies - 31 through 38 (of 38 total)
  • The topic ‘Postman SMTP Mailer/Email Log is prone to a cross-site scripting vulnerability’ is closed to new replies.