WordPress Postie plugin <= 1.9.40 - Stored Cross-Site Scripting (XSS) and post submission spoofing vulnerabilities

Stored Cross-Site Scripting XSS and post submission spoofing vulnerabilities found by V1n1v131r4 in WordPress Postie plugin versions = 1.9.40. Solution 06.01.2020 - we were unable to find a patched version of this plugin...

Postie <= 1.9.40 - Post Submission Spoofing & Stored XSS

"The Postie plugin for WordPress only allows posting of articles submitted by authorized users through a mailing list registered in the plugin settings. However through the email sender's spoofing technique, it was possible to bypass the plugin settings and publish a post as having been sent by a...