Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App vulnerabilities

Known security issues in the Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: post-smtp
Latest version: 4.0.2
Active installs: 300,000+
Known vulnerabilities: 37
Data updated: 2026-10-18 15:08 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 4.0.2 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 4.0.2
Vulnerability	Severity	CVSS	Affected versions	Published
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log) CVE-2026-75962 · Source	High	7.2	< 4.0.2	2026-08-26

Fixed in version 4.0.1 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 4.0.1
Vulnerability	Severity	CVSS	Affected versions	Published
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 4.0.0-beta.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change CVE-2026-81278 · Source	Medium	5.4	< 4.0.1	2026-05-28

Fixed in version 3.9.0 (2)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 3.9.0
Vulnerability	Severity	CVSS	Affected versions	Published
Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type' CVE-2026-3090 · Source	Not rated	-	< 3.9.0	0000-00-00
Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite CVE-2026-2559 · Source	Not rated	-	< 3.9.0	0000-00-00

Fixed in version 3.6.3 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 3.6.3
Vulnerability	Severity	CVSS	Affected versions	Published
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting CVE-2026-48838 · Source	High	7.1	< 3.6.3	2026-04-30

Fixed in version 3.6.2 (2)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 3.6.2
Vulnerability	Severity	CVSS	Affected versions	Published
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update CVE-2025-12887 · Source	Medium	5.4	< 3.6.2	2025-12-03
[en] Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 3.6.1. CVE-2025-67563 · Source	Medium	5.3	< 3.6.2	2025-12-09

Fixed in version 3.6.1 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 3.6.1
Vulnerability	Severity	CVSS	Affected versions	Published
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure CVE-2025-11833 · Source	Critical	9.8	< 3.6.1	2025-10-31

Fixed in version 3.4.2 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 3.4.2
Vulnerability	Severity	CVSS	Affected versions	Published
Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update CVE-2025-9219 · Source	Not rated	-	< 3.4.2	0000-00-00

Fixed in version 3.3.0 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 3.3.0
Vulnerability	Severity	CVSS	Affected versions	Published
Post SMTP <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via Email Log Exposure CVE-2025-24000 · Source	High	8.8	< 3.3.0	2025-07-21

Fixed in version 3.1.3 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 3.1.3
Vulnerability	Severity	CVSS	Affected versions	Published
Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter CVE-2024-13844 · Source	Medium	4.9	< 3.1.3	2025-03-07

Fixed in version 3.1.0 (2)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 3.1.0
Vulnerability	Severity	CVSS	Affected versions	Published
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 · Source	Medium	6.1	< 3.1.0	2026-04-30
Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting CVE-2025-0521 · Source	Medium	6.1	< 3.1.0	0000-00-00

Fixed in version 2.9.12 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.9.12
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Post SMTP Plugin <= 2.9.11 is vulnerable to Broken Access Control CVE-2025-22800 · Source	Medium	4.3	< 2.9.12	2025-01-07

Fixed in version 2.9.10 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.9.10
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Post SMTP Plugin <= 2.9.9 is vulnerable to SQL Injection CVE-2024-52436 · Source	High	7.6	< 2.9.10	2024-11-15

Fixed in version 2.9.4 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.9.4
Vulnerability	Severity	CVSS	Affected versions	Published
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection CVE-2024-5207 · Source	High	7.2	< 2.9.4	2024-05-22

Fixed in version 2.8.8 (2)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.8.8
Vulnerability	Severity	CVSS	Affected versions	Published
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API CVE-2023-6875 · Source	Critical	9.8	< 2.8.8	2024-01-10
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device CVE-2023-7027 · Source	Medium	5.4	< 2.8.8	2024-01-02

Fixed in version 2.8.7 (5)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.8.7
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Post SMTP Mailer/Email Log Plugin <= 2.8.6 is vulnerable to Broken Access Control CVE-2023-52233 · Source	High	8.6	< 2.8.7	2024-01-05
Post SMTP < 2.8.7 - Admin+ SQL Injection CVE-2023-6620 · Source	High	7.2	< 2.8.7	2023-12-21
WordPress Post SMTP Mailer/Email Log Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS) CVE-2024-29128 · Source	High	7.1	< 2.8.7	2024-03-19
Post SMTP < 2.8.7 - Reflected Cross-Site Scripting CVE-2023-6621 · Source	Medium	6.1	< 2.8.7	2024-01-03
POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg CVE-2023-6629 · Source	Medium	6.1	< 2.8.7	2024-01-02

Fixed in version 2.7.1 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.7.1
Vulnerability	Severity	CVSS	Affected versions	Published
POST SMTP Mailer <= 2.7.0 - Unauthenticated Stored Cross-Site Scripting CVE-2023-5958 · Source	Medium	6.1	< 2.7.1	2023-11-06

Fixed in version 2.6.1 (3)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.6.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Post SMTP Mailer/Email Log Plugin < 2.6.1 is vulnerable to SQL Injection No CVE assigned · Source	Not rated	-	< 2.6.1	2023-10-04
Post SMTP <= 2.6.0 - Authenticated (Administrator+) SQL Injection No CVE assigned · Source	Not rated	-	< 2.6.1	2023-10-03
Post SMTP < 2.6.1 - Authenticated (Administrator+) SQL Injection No CVE assigned · Source	Not rated	-	< 2.6.1	-

Fixed in version 2.5.8 (2)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.5.8
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Post SMTP Mailer/Email Log Plugin < 2.5.8 is vulnerable to Cross Site Scripting (XSS) CVE-2023-33999 · Source	High	7.1	< 2.5.8	2023-07-18
Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email CVE-2023-3082 · Source	Medium	6.1	< 2.5.8	2023-07-11

Fixed in version 2.5.7 (2)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.5.7
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Post SMTP Mailer/Email Log Plugin < 2.5.7 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-3179 · Source	High	8.8	< 2.5.7	2023-06-26
WordPress Post SMTP Mailer/Email Log Plugin < 2.5.7 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-3178 · Source	Medium	4.3	< 2.5.7	2023-06-26

Fixed in version 2.1.7 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.1.7
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Post SMTP Mailer/Email Log plugin <= 2.1.6 - Authenticated Blind Server-Side Request Forgery (SSRF) vulnerability CVE-2022-2352 · Source	High	7.2	< 2.1.7	2022-09-05

Fixed in version 2.1.4 (1)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.1.4
Vulnerability	Severity	CVSS	Affected versions	Published
Post SMTP Mailer/Email Log <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2022-2351 · Source	Medium	4.8	< 2.1.4	2022-08-18

Fixed in version 2.0.21 (4)

Post SMTP - Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Fixed in version 2.0.21
Vulnerability	Severity	CVSS	Affected versions	Published
POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass CVE-2021-4422 · Source	Medium	4.3	< 2.0.21	2021-03-01
CVE split into individual CVE IDs for each software record. CVE-2021-4342 · Source	Low	0.0	< 2.0.21	2023-06-07
WordPress Post SMTP Mailer/Email Log plugin <= 2.0.20 - Cross-Site Request Forgery (CSRF) nonce validation vulnerability No CVE assigned · Source	Not rated	-	< 2.0.21	2021-02-11
404 Page Not Found No CVE assigned · Source	Not rated	-	< 2.0.21	-

Check every plugin on your site automatically

Install the free Webforta Security plugin for WordPress and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.