CVE-2026-48838
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Versions of Post SMTP <= 3.6.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
Risk Assessment
This vulnerability may lead to user data theft or session hijacking, posing a serious threat to the application's security and the organization's data.
Recommendation
It is recommended to update to the latest version of Post SMTP to mitigate this vulnerability and conduct a security audit of the application.
Other vulnerabilities in Post SMTP
See all- CVE-2026-81278Medium
Missing Authorization vulnerability in Post SMTP from 4.0.0 through beta.1. Allows exploiting incorrectly configured access control security levels.
- CVE-2025-67563Medium
The Post SMTP plugin by Saad Iqbal is vulnerable to Missing Authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects Post SMTP from n/a through <= 3.6.1.
- CVE-2025-12887Medium
The Post SMTP plugin for WordPress in versions up to and including 3.6.1 is vulnerable to authorization bypass. The 'handle_gmail_oauth_redirect' function does not properly verify that a user is authorized to update OAuth tokens, allowing authenticated attackers with subscriber-level access and above to inject invalid or attacker-controlled OAuth credentials.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS