WordPress Plugin Vulnerabilities

Post SMTP < 3.1.0 - Unauthenticated Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the from and subject parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
post-smtp
Fixed in 3.1.0

References

CVE
CVE-2025-0521
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/366dfbf1-870c-4ce3-abc4-a2b2f4e72175

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
zer0gh0st
Verified
No
WPVDB ID
dcede985-f0fc-4868-ad29-eecbb4548dc3

Timeline

Publicly Published
2025-02-17 (about 1 year ago)
Added
2025-02-20 (about 1 year ago)
Last Updated
2025-02-20 (about 1 year ago)

Other

Published
Title
Published
2025-09-30
Title
WooCommerce Vehicle Parts Finder < 3.8 - Unauthenticated Stored Cross-Site Scripting
Published
2021-08-25
Title
Contact Form 7 Zoho < 1.1.8 - Reflected Cross-Site Scripting
Published
2026-05-07
Title
E2Pdf – Export Pdf Tool for WordPress < 1.32.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Published
2024-10-28
Title
PostX < 4.1.16 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2024-07-19
Title
Leaflet Maps Marker < 3.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting