Check & Log Email – Easy Email Testing & Mail logging < 2.0.13 - Unauthenticated Stored Cross-Site Scripting

subjectormessagecolumn rendering. * **Payload**:. * **Vector**: wp-login.php?action=lostpassword`.

*   Actually, let's look at `include/Core/UI/Page/Check_Email_Analyzer.php` one more time.
*   It's a "Free tool".
*   It might have a public-facing page or a way to trigger analysis.
*   But the "Email Log" is the core feature.

*   I will use the "Lost Password" vector as the primary example, as it's the most reliable way to inject into an email log without needing a plugin-specific public endpoint.

*Wait, one more check*:
The description says: "inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
This sounds like it could be a public page.
Does this plugin create any public pages?
Not normally. It's an admin tool.
So the victim is the **Admin**.

*   1.  Vulnerability Summary (Stored XSS in Logs).
*   2.  Attack Vector (Lost Password trigger).
*   3.  Code Flow (wp_mail -> Logger -> DB -> Admin Page).
*   4.  Nonce Acquisition (None needed for Lost Password).
*   5.  Exploitation Strategy (Step-