290 matches found
Post SMTP <= 3.6.0 - Email Log Disclosure
Post SMTP WordPress plugin = 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication. id: CVE-2025-11833 info: name: Post SMTP = 3.6.0 -...
CVE-2025-24000-exploit
CVE-2025-24000 — Post SMTP Privilege Escalation Exploit Overview This script exploits CVE-2025-24000 , a high-severity broken access control vulnerability in the Post SMTP WordPress plugin versions ≤ 3.2.0. It allows any authenticated user with a low-privilege account e.g. Subscriber to access th...
CVE-2026-75962
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...
CVE-2026-75962
The Post SMTP WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.1 . The root cause is insufficient input sanitization and output escaping regarding the 'user_email' parameter. Attackers can bypass the plugin's validator by using numeric HT...
EUVD-2026-92961
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...
CVE-2026-75962 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...
PT-2026-106333
Name of the Vulnerable Software and Affected Versions Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App versions prior to 4.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform...
CVE-2026-75962: Improper Neutralization of Input During Web Page Generation
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...
WordPress Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability
Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Post SMTP versions = 4.0.1...
CVE-2026-81278
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...
EUVD-2026-68803
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...
CVE-2026-81278
WPExperts Post SMTP WordPress plugin is affected by a Missing Authorization (Settings Change) vulnerability in versions 4.0.0 through 4.0.0-beta.1 . The flaw allows low-privileged users to exploit incorrectly configured access control levels, resulting in low integrity and availability impact wit...
CVE-2026-81278 WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...
CVE-2026-81278 WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...
CVE-2026-81278: Missing Authorization
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...
PT-2026-84000
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...
WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability
Settings Change vulnerability discovered by mad4cyber in WordPress Plugin Post SMTP versions 4.0.0-beta.1...
CVE-2026-48838
Unauthenticated Cross Site Scripting XSS in Post SMTP = 3.6.2 versions...