EUVD-2026-12841

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eventtype’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and...

CVE-2026-2991

creationtimestamp| type| source ---|---|--- 2026-03-18 17:28:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhdz6jqerg2u 2026-04-04 00:00:26+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/78673 2026-04-04 03:00:05+00:00| published-proof-of-concept|...

CVE-2026-33295

creationtimestamp| type| source ---|---|--- 2026-03-18 17:25:58+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv 2026-03-22 16:17:09+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-33295 2026-03-22...

CVE-2026-32731

creationtimestamp| type| source ---|---|--- 2026-03-18 17:17:17+00:00| published-proof-of-concept| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mwxc-m426-3f78 2026-03-18 23:20:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhemsomimm2u 2026-03-19...

CVE-2026-31870

creationtimestamp| type| source ---|---|--- 2026-03-18 17:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhdxlet7hw2x 2026-03-20 11:11:34+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mhieznfew22h...

CVE-2026-2559

The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleoffice365oauthredirect function in all versions up to, and including, 3.8.0. This is due to the function being hooked to admininit without any currentusercan check ...

CVE-2026-3090 Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eventtype’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and...

CVE-2026-3090 Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eventtype’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and...

CVE-2026-3090

The CVE-2026-3090 entry describes a Stored Cross-Site Scripting vulnerability in the Post SMTP WordPress plugin (versions up to 3.8.0). The issue is triggered by the event_type parameter and arises from insufficient input sanitization and output escaping. Exploitation requires unauthenticated acc...

CVE-2026-3090

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eventtype’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and...

CVE-2026-2559 Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite

The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleoffice365oauthredirect function in all versions up to, and including, 3.8.0. This is due to the function being hooked to admininit without any currentusercan check ...

CVE-2026-2559

Post SMTP for WordPress is vulnerable up to version 3.8.0 due to a missing capability check in handle_office365_oauth_redirect() (hooked to admin_init without current_user_can() or nonce verification). Authenticated attackers with Subscriber level access+ can overwrite the Office 365 OAuth config...

CVE-2026-2559

The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleoffice365oauthredirect function in all versions up to, and including, 3.8.0. This is due to the function being hooked to admininit without any currentusercan check ...

CVE-2026-2559 Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite

The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleoffice365oauthredirect function in all versions up to, and including, 3.8.0. This is due to the function being hooked to admininit without any currentusercan check ...

CVE-2025-43510

creationtimestamp| type| source ---|---|--- 2026-03-18 15:22:35+00:00| exploited| https://t.me/truesecator/8007 2026-03-19 21:02:58+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mhgvmd65hb2b 2026-03-20 12:00:00+00:00| seen|...

CVE-2026-32946

creationtimestamp| type| source ---|---|--- 2026-03-18 14:38:19+00:00| seen| https://bsky.app/profile/undercode.bsky.social/post/3mhdpnlum2t2i 2026-03-20 06:12:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhhud4kx4o2e...

CVE-2026-30922

creationtimestamp| type| source ---|---|--- 2026-03-18 13:41:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhdmitkffv2s 2026-03-20 23:29:24+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mhjob4fnpw2z 2026-03-20 23:40:09+00:00| seen|...

WordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Ultimate Post Kit versions = 4.0.21...

Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clonebulkactionhandler and republishrequest functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with...

EUVD-2026-12800

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clonebulkactionhandler and republishrequest functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with...