Cross Site Scripting Vulnerability in Post SMTP by WordPress
CVE-2026-48838

7.1HIGH

Key Information:

Vendor

WordPress
Status
Post Smtp
Vendor
CVE Published:
15 June 2026

What is CVE-2026-48838?

The vulnerability in the Post SMTP plugin allows unauthenticated attackers to execute arbitrary scripts on affected sites. By exploiting this Cross Site Scripting (XSS) vulnerability, malicious users can craft inputs that, when processed by the plugin, could lead to unauthorized actions or data exposure in the context of the user’s browser. If your site uses Post SMTP versions up to 3.6.2, it is crucial to apply the necessary security updates to mitigate the risks associated with this vulnerability. Regular monitoring and updates are essential to maintain the integrity of your WordPress install.

Affected Version(s)

Post SMTP <= 3.6.2

References

https://patchstack.com/database/wordpress/plugin/post-smt...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mcdruid | Patchstack Bug Bounty Program
.