Postie < 1.9.41 - Post Submission Spoofing & Stored Cross-Site Scripting (XSS)

Description

"The Postie plugin for WordPress only allows posting of articles submitted by authorized users through a mailing list registered in the plugin settings.

However through the email sender's spoofing technique, it was possible to bypass the plugin settings and publish a post as having been sent by a valid user."

This could be used to create a post with an XSS payload.