Plugin icon

Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App

post-smtp

Vulnerabilities:

22

Last Updated:

December 17, 2025

Active Installs:

400000

Published
Title
Fixed in
CVSS
Published
2025-12-03
Title
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App < 3.6.2 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update
Fixed in
Fixed in 3.6.2
CVSS
5.4 (medium)
Published
2025-10-31
Title
Post SMTP < 3.6.1 - Account Takeover via Unauthenticated Email Log Disclosure
Fixed in
Fixed in 3.6.1
CVSS
9.8 (critical)
Published
2025-09-02
Title
Post SMTP < 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update
Fixed in
Fixed in 3.4.2
CVSS
4.3 (medium)
Published
2025-07-21
Title
Post SMTP < 3.3.0 - Subscriber+ Account Takeover via Email Log Exposure
Fixed in
Fixed in 3.3.0
CVSS
8.8 (high)
Published
2025-03-07
Title
Post SMTP < 3.1.3 - Authenticated (Administrator+) SQL Injection via columns Parameter
Fixed in
Fixed in 3.1.3
CVSS
4.9 (medium)
Published
2025-02-17
Title
Post SMTP < 3.1.0 - Unauthenticated Stored XSS
Fixed in
Fixed in 3.1.0
CVSS
8.8 (high)
Published
2025-01-07
Title
Post SMTP < 2.9.12 - Missing Authorization via regenerate_qrcode()
Fixed in
Fixed in 2.9.12
CVSS
4.3 (medium)
Published
2024-11-15
Title
Post SMTP < 2.9.10 - Admin+ SQLi
Fixed in
Fixed in 2.9.10
CVSS
4.1 (medium)
Published
2024-05-22
Title
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress < 2.9.4 - Administrator+ SQL Injection
Fixed in
Fixed in 2.9.4
CVSS
6.6 (medium)
Published
2024-01-10
Title
POST SMTP Mailer < 2.8.8 - Authorization Bypass via type connect-app API
Fixed in
Fixed in 2.8.8
CVSS
9.8 (critical)
Published
2024-01-02
Title
POST SMTP Mailer < 2.8.8 - Unauthenticated Stored Cross-Site Scripting via device
Fixed in
Fixed in 2.8.8
CVSS
8.8 (high)
Published
2023-12-21
Title
Post SMTP < 2.8.7 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.8.7
CVSS
7.1 (high)
Published
2023-12-21
Title
Post SMTP < 2.8.7 - Admin+ SQL Injection
Fixed in
Fixed in 2.8.7
CVSS
4.1 (medium)
Published
2023-11-06
Title
POST SMTP Mailer < 2.7.1 - Unauthenticated Cross-site Scripting
Fixed in
Fixed in 2.7.1
CVSS
8.8 (high)
Published
2023-10-03
Title
Post SMTP < 2.6.1 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 2.6.1
CVSS
7.2 (high)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.5.8
CVSS
6.1 (medium)
Published
2023-07-11
Title
Post SMTP < 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Email Contents
Fixed in
Fixed in 2.5.8
CVSS
7.2 (high)
Published
2023-06-26
Title
POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF
Fixed in
Fixed in 2.5.7
CVSS
4.3 (medium)
Published
2023-06-26
Title
POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF
Fixed in
Fixed in 2.5.7
CVSS
6.5 (medium)
Published
2022-09-05
Title
Post SMTP < 2.1.7 - Admin+ Blind SSRF
Fixed in
Fixed in 2.1.7
CVSS
2.7 (low)
Published
2022-08-22
Title
Post SMTP < 2.1.4 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 2.1.4
CVSS
3.4 (low)
Published
2021-02-12
Title
Post SMTP Mailer/Email Log < 2.0.21 - CSRF Nonce Bypass
Fixed in
Fixed in 2.0.21
CVSS
4.3 (medium)