CVE-2026-66606

Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...

EUVD-2026-63293

Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...

CVE-2026-66606

An unauthenticated reflected/stored XSS vulnerability exists in the WordPress SmartSMTP plugin through version 1.2.0. An attacker can inject malicious scripts without authentication; a victim triggering the payload could have their session cookies stolen or admin actions hijacked. CVSS 3.1 scores...

CVE-2026-66606 WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...