Stored Cross-Site Scripting Vulnerability in Postie Plugin for WordPress

CVE-2026-100175

What is CVE-2026-100175?

The Postie plugin for WordPress exhibits a vulnerability allowing Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. Unauthenticated attackers can exploit this through the ?postie=get-mail endpoint, which lacks necessary capability checks. The email processing mechanism arbitrarily removes WordPress's output filters, enabling malicious web scripts to be stored in post content. As a result, these scripts can execute whenever an injected page is accessed, posing significant security risks for site users.

References