WordPress security changelog
HIGH CVE-2026-75962 Deferred

Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Stored XSS in Multisite failed email logs

On WordPress Multisite with public registration enabled, an unauthenticated attacker can submit user_email containing numeric HTML character references. WordPress accepts the address, but Post SMTP rejects it and stores the attacker-controlled value verbatim in a failed-send exception message. Insufficient sanitization and output escaping allow script execution when a user views the injected email-log output. The exact log-rendering function and viewer role are undisclosed. Although the supplied CVSS vector has UI:N, the description requires someone to view the affected output. Affected versions: <= 4.0.1. The official Post SMTP 4.0.2 changelog confirms the matching Multisite failed-log XSS fix.

CVE / CNA score 7.2 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
Plugin slug
post-smtp
Affected
<= 4.0.1
Safe version
4.0.2
Published
Oct 06, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Oct 06, 2026 and is one of 29 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Post SMTP to 4.0.2 or a later supported release. Escape addresses and exception text when rendering email logs, keep validation failures as inert text, and remove any malicious values already stored in logs. Official changelog: https://wordpress.org/plugins/post-smtp/#developers.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable without authentication on WordPress Multisite installations with public registration enabled, as WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, persisting the attacker-controlled address verbatim to the email log via the failed-send exception message.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

Primary and upstream sources