Post SMTP vulnerabilities

Missing Authorization vulnerability in Post SMTP from 4.0.0 through beta.1. Allows exploiting incorrectly configured access control security levels.

Versions of Post SMTP <= 3.6.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.

The Post SMTP plugin by Saad Iqbal is vulnerable to Missing Authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects Post SMTP from n/a through <= 3.6.1.

The Post SMTP plugin for WordPress in versions up to and including 3.6.1 is vulnerable to authorization bypass. The 'handle_gmail_oauth_redirect' function does not properly verify that a user is authorized to update OAuth tokens, allowing authenticated attackers with subscriber-level access and above to inject invalid or attacker-controlled OAuth credentials.