CVE-2026-16636

creationtimestamp| type| source ---|---|--- 2026-08-06 08:54:44+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msfo72edfo2j 2026-08-07 02:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mshidguasn2n...

CVE-2026-16636 FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...