Post SMTP <= 3.6.0 - Email Log Disclosure

Post SMTP WordPress plugin = 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication. id: CVE-2025-11833 info: name: Post SMTP = 3.6.0 -...

CVE-2025-24000-exploit

CVE-2025-24000 — Post SMTP 権限昇格エクスプロイト 概要 このスクリプトは CVE-2025-24000 を悪用します。これは Post SMTP WordPress プラグイン （バージョン ≤ 3.2.0）における重大なアクセス制御の脆弱性です。低権限アカウント（例: 購読者）を持つ任意の認証ユーザーが、プラグインの REST API メールログにアクセスし、管理者パスワードリセットリンクを盗み取り、管理者アカウントを乗っ取ることができます。 CVE: CVE-2025-24000 プラグイン: Post SMTP WPExperts 影響を受けるバージョン...

CVE-2026-81278

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

CVE-2026-81278

WPExperts Post SMTP WordPress plugin is affected by a Missing Authorization (Settings Change) vulnerability in versions 4.0.0 through 4.0.0-beta.1 . The flaw allows low-privileged users to exploit incorrectly configured access control levels, resulting in low integrity and availability impact wit...

CVE-2026-81278 WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

EUVD-2026-68803

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability

Settings Change vulnerability discovered by mad4cyber in WordPress Plugin Post SMTP versions 4.0.0-beta.1...

CVE-2026-48838

Unauthenticated Cross Site Scripting XSS in Post SMTP = 3.6.2 versions...

CVE-2026-48838 WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Post SMTP = 3.6.2 versions...

EUVD-2026-36845

Unauthenticated Cross Site Scripting XSS in Post SMTP = 3.6.2 versions...

CVE-2026-48838

CVE-2026-48838 covers an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Post SMTP plugin, versions

PT-2026-49475

Unauthenticated Cross Site Scripting XSS in Post SMTP = 3.6.2 versions...

WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by mcdruid in WordPress Plugin Post SMTP versions = 3.6.2...

WordPress Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin <= 3.0.0 - Unauthenticated Reflected Cross-Site Scripting vulnerability

Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Post SMTP versions = 3.0.0...

Exploit for CVE-2025-24000

CVE-2025-24000 — Post SMTP Privilege Escalation Exploit Ov...

CVE-2026-3090

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eventtype’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and...

WordPress Post SMTP plugin <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type' vulnerability

Unauthenticated Stored Cross-Site Scripting via 'eventtype' vulnerability discovered by hoshino in WordPress Plugin Post SMTP versions = 3.8.0...

WordPress Post SMTP plugin <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite vulnerability

Missing Authorization to Authenticated Subscriber+ Office 365 OAuth Configuration Overwrite vulnerability discovered by Michael Iden Mickhat - Hack The Box in WordPress Plugin Post SMTP versions = 3.8.0...

EUVD-2026-12841

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eventtype’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and...

CVE-2026-2559

The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleoffice365oauthredirect function in all versions up to, and including, 3.8.0. This is due to the function being hooked to admininit without any currentusercan check ...