WordPress plugin · post-smtp
Is Post SMTP safe?
Safe on 4.0.2 or newer.
The current version, 4.0.2, is past every affected range on record (28 of 29 records list one; 1 doesn’t, so check it below). Keep it updated and you’re clear of them.
- Flaws on record
- 29
- High or critical
- 16
- Exploited
- none
- Current version
- 4.0.2
- Last updated
- Sep 24, 2026
- Active installs
- 300,000+
Every recorded flaw
- Oct 6, 2026Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Stored Cross-Site ScriptingCVE-2026-75962 · affects up to 4.0.1 · reported by WordfenceHigh 7.2
- Aug 31, 2026Post SMTP: Missing AuthorizationCVE-2026-81278 · reported by PatchstackMedium 5.4
- Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.CVE-2026-48838 · affects up to 3.6.2 · reported by PatchstackHigh 7.1
- Mar 18, 2026Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Stored Cross-Site ScriptingCVE-2026-3090 · affects up to 3.8.0 · reported by WordfenceHigh 7.2
- Mar 18, 2026Post SMTP: Unauthorized modification of dataCVE-2026-2559 · affects up to 3.8.0 · reported by WordfenceMedium 5.3
- Dec 9, 2025Post SMTP: Missing AuthorizationCVE-2025-67563 · affects up to 3.6.1 · reported by PatchstackMedium 5.3
- Dec 3, 2025Post SMTP: Authorization bypassCVE-2025-12887 · affects up to 3.6.1 · reported by WordfenceMedium 5.4
- Nov 1, 2025Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App: Unauthorized access of dataCVE-2025-11833 · affects up to 3.6.0 · reported by Wordfence61% oddsCritical 9.8
- Sep 3, 2025The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin forCVE-2025-9219 · affects up to 3.4.1 · reported by WordfenceMedium 4.3
- Aug 7, 2025Post SMTP: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-24000 · affects up to 3.2.0 · reported by PatchstackHigh 8.8
- Mar 8, 2025Post SMTP: Generic SQL InjectionCVE-2024-13844 · affects up to 3.1.2 · reported by WordfenceMedium 4.9
- Feb 18, 2025Post SMTP: Stored Cross-Site ScriptingCVE-2025-0521 · affects up to 3.0.2 · reported by WordfenceHigh 7.2
- Jan 13, 2025Post SMTP: Missing AuthorizationCVE-2025-22800 · affects up to 2.9.11 · reported by PatchstackMedium 4.3
- Nov 18, 2024Post SMTP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-52436 · affects up to 2.9.9 · reported by PatchstackHigh 7.6
- Jun 11, 2024Post SMTP Mailer/Email Log: Missing AuthorizationCVE-2023-52233 · affects up to 2.8.6 · reported by PatchstackHigh 8.6
- May 30, 2024POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications: Time-based SQL InjectionCVE-2024-5207 · affects up to 2.9.3 · reported by WordfenceHigh 7.2
- Mar 19, 2024POST SMTP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29128 · affects up to 2.8.6 · reported by PatchstackHigh 7.1
- Jan 16, 2024POST SMTP Mailer: Does not have proper CSRF checks in some AJAX actionsCVE-2023-3178 · fixed in 2.5.7 · reported by WPScanMedium 4.3
- Jan 15, 2024POST SMTP Mailer: Does not properly sanitise and escape several parameters before using them in SQL statementsCVE-2023-6620 · fixed in 2.8.7 · reported by WPScan14% oddsHigh 7.2
- Jan 11, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Unauthorized access of data and modification of dataCVE-2023-6875 · affects up to 2.8.7 · reported by Wordfence90% oddsCritical 9.8
- Jan 3, 2024POST SMTP: Does not sanitise and escape the msg parameter before outputting it back in the pageCVE-2023-6621 · fixed in 2.8.7 · reported by WPScanMedium 6.1
- Jan 3, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Stored Cross-Site ScriptingCVE-2023-7027 · affects up to 2.8.7 · reported by WordfenceHigh 7.2
- Jan 3, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Reflected Cross-Site ScriptingCVE-2023-6629 · affects up to 2.8.6 · reported by WordfenceMedium 6.1
- Nov 27, 2023POST SMTP Mailer: Does not escape email message content before displaying it in the backendCVE-2023-5958 · fixed in 2.7.1 · reported by WPScanMedium 6.1
- Jul 17, 2023POST SMTP Mailer: Does not have proper CSRF checks in some AJAX actionsCVE-2023-3179 · fixed in 2.5.7 · reported by WPScanHigh 8.8
- Jul 12, 2023POST SMTP Mailer: Cross-Site Request ForgeryCVE-2021-4422 · affects up to 2.0.20 · reported by WordfenceMedium 4.3
- Jul 12, 2023Post SMTP: Stored Cross-Site ScriptingCVE-2023-3082 · affects up to 2.5.7 · reported by WordfenceHigh 7.2
- Sep 26, 2022Post SMTP Mailer/Email Log: Does not have proper authorisation in some AJAX actionsCVE-2022-2352 · fixed in 2.1.7 · reported by WPScan1.4% oddsHigh 7.2
- Sep 16, 2022Post SMTP Mailer/Email Log: Does not escape some of its settings before outputting them in the admins dashboardCVE-2022-2351 · fixed in 2.1.4 · reported by WPScanMedium 4.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.