CVE-2023-1090: 
WordPress vulnerability analysis and mitigation

CVE-2023-1090 affects the WP SMTP Mailing Queue WordPress plugin versions below 2.0.1. The vulnerability was discovered and publicly disclosed on April 5, 2023. This security issue involves a Stored Cross-Site Scripting (XSS) vulnerability that affects high-privilege users such as administrators (WPScan).

The vulnerability exists because the plugin does not properly sanitize and escape some of its settings, which could allow administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, such as in multisite setups. The vulnerability has been assigned a CVSS score of 3.5 (low) and is classified as CWE-79: Cross-Site Scripting (WPScan).

The vulnerability allows high-privilege users such as administrators to execute stored XSS attacks through the plugin's settings, potentially affecting other users who access the affected pages. This is particularly concerning in multisite WordPress installations where unfiltered HTML is typically restricted (WPScan).

The vulnerability has been fixed in version 2.0.1 of the WP SMTP Mailing Queue plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).