Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    28 vulnerabilities found for Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App by saadiqbal

    CVE-2024-13362 (GCVE-0-2024-13362)

    Vulnerability from nvd – Published: 2026-05-01 05:29 – Updated: 2026-05-01 13:23
    VLAI
    Title
    Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
    Summary
    Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-01 13:23 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    sebet Go Fetch Jobs (for WP Job Manager) Affected: 0 , ≤ 1.8.4.8.1 (semver)
    		Create a notification for this product.
    5starplugins Dynamic Copyright Year Affected: 0 , ≤ 1.0.4 (semver)
    		Create a notification for this product.
    peterschulznl Code Manager Affected: 0 , ≤ 1.0.40 (semver)
    		Create a notification for this product.
    bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior Affected: 0 , ≤ 1.1.3 (semver)
    		Create a notification for this product.
    yuvalo Goal Tracker – Custom Event Tracking for GA4 Affected: 0 , ≤ 1.1.5 (semver)
    		Create a notification for this product.
    essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent Affected: 0 , ≤ 1.1.13 (semver)
    		Create a notification for this product.
    josevega WP Page Templates Affected: 0 , ≤ 1.1.16 (semver)
    		Create a notification for this product.
    hkdigitalagency Payment Gateway for ACBA BANK Affected: 0 , ≤ 1.2.6 (semver)
    		Create a notification for this product.
    princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress Affected: 0 , ≤ 1.2.7 (semver)
    		Create a notification for this product.
    spiderdevs Forumax – AI Powered Advanced Community Forum Plugin Affected: 0 , ≤ 1.2.7 (semver)
    		Create a notification for this product.
    seezee Five-Star Ratings Shortcode Affected: 0 , ≤ 1.2.56 (semver)
    		Create a notification for this product.
    oxilab Product Layouts for WooCommerce Affected: 0 , ≤ 1.3.1 (semver)
    		Create a notification for this product.
    mr2p Meta Field Block – Display custom fields in the Block Editor without coding Affected: 0 , ≤ 1.3.3 (semver)
    		Create a notification for this product.
    themelocation Custom WooCommerce Checkout Fields Editor Affected: 0 , ≤ 1.3.4 (semver)
    		Create a notification for this product.
    100plugins Open User Map Affected: 0 , ≤ 1.4.0 (semver)
    		Create a notification for this product.
    wpdever WP Notification Bell Affected: 0 , ≤ 1.4.2 (semver)
    		Create a notification for this product.
    themelocation Remove Add to Cart WooCommerce Affected: 0 , ≤ 1.4.7 (semver)
    		Create a notification for this product.
    princeahmed File Manager for Google Drive – Integrate Google Drive Affected: 0 , ≤ 1.4.9 (semver)
    		Create a notification for this product.
    5starplugins Marijuana Age Verify Affected: 0 , ≤ 1.5.5 (semver)
    		Create a notification for this product.
    infosatech RevivePress – Keep your Old Content Evergreen Affected: 0 , ≤ 1.5.8 (semver)
    		Create a notification for this product.
    nicheaddons Restaurant & Cafe Addon for Elementor Affected: 0 , ≤ 1.5.8 (semver)
    		Create a notification for this product.
    paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter Affected: 0 , ≤ 1.5.10 (semver)
    		Create a notification for this product.
    unitecms Unlimited Elements For Elementor Affected: 0 , ≤ 1.5.140 (semver)
    		Create a notification for this product.
    meowcrew Role Based Pricing for Woo by Meow Crew Affected: 0 , ≤ 1.6.0 (semver)
    		Create a notification for this product.
    nicheaddons Primary Addon for Elementor Affected: 0 , ≤ 1.6.0 (semver)
    		Create a notification for this product.
    5starplugins Featured Images in RSS for Mailchimp & More Affected: 0 , ≤ 1.6.3 (semver)
    		Create a notification for this product.
    wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI Affected: 0 , ≤ 1.6.3 (semver)
    		Create a notification for this product.
    kofimokome Message Filter for Contact Form 7 Affected: 0 , ≤ 1.6.3.2 (semver)
    		Create a notification for this product.
    paretodigital Embedder for Google Reviews Affected: 0 , ≤ 1.6.6 (semver)
    		Create a notification for this product.
    interactivegeomaps MapGeo – Interactive Geo Maps Affected: 0 , ≤ 1.6.22 (semver)
    		Create a notification for this product.
    wpbits WPBITS Addons For Elementor Page Builder Affected: 0 , ≤ 1.7 (semver)
    		Create a notification for this product.
    toddhalfpenny Widgets on Pages Affected: 0 , ≤ 1.7 (semver)
    		Create a notification for this product.
    rebelcode Spotlight Social Feeds – Block, Shortcode, and Widget Affected: 0 , ≤ 1.7.0 (semver)
    		Create a notification for this product.
    tobias_conrad WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms Affected: 0 , ≤ 1.7.0 (semver)
    		Create a notification for this product.
    webfactory AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o Affected: 0 , ≤ 1.7.2 (semver)
    		Create a notification for this product.
    hasanazizul Text To Speech TTS Accessibility Affected: 0 , ≤ 1.7.34 (semver)
    		Create a notification for this product.
    5starplugins Easy Age Verify Affected: 0 , ≤ 1.8.5 (semver)
    		Create a notification for this product.
    senols AI Puffer – Chat. Create. Automate. (formerly AI Power) Affected: 0 , ≤ 1.8.99 (semver)
    		Create a notification for this product.
    damian-gora Justified Gallery Affected: 0 , ≤ 1.9.0 (semver)
    		Create a notification for this product.
    mapster Mapster WP Maps Affected: 0 , ≤ 1.9.0 (semver)
    		Create a notification for this product.
    streamweasels StreamWeasels Twitch Integration Affected: 0 , ≤ 1.9.2 (semver)
    		Create a notification for this product.
    xplodedthemes XT Variation Swatches for WooCommerce Affected: 0 , ≤ 1.9.4 (semver)
    		Create a notification for this product.
    bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection Affected: 0 , ≤ 1.9.8 (semver)
    		Create a notification for this product.
    kaizencoders URL Shortify – Simple and Easy URL Shortener Affected: 0 , ≤ 1.10.4 (semver)
    		Create a notification for this product.
    uriahs-victor Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce Affected: 0 , ≤ 1.10.6 (semver)
    		Create a notification for this product.
    cyberhobo Geo Mashup Affected: 0 , ≤ 1.13.15 (semver)
    		Create a notification for this product.
    josevega Disable Payment Methods based on cart conditions for WooCommerce Affected: 0 , ≤ 1.16.3 (semver)
    		Create a notification for this product.
    pagup Automatic Internal Links for SEO by Pagup Affected: 0 , ≤ 2.0.0 (semver)
    		Create a notification for this product.
    enweby Full Screen Background Affected: 0 , ≤ 2.0.2 (semver)
    		Create a notification for this product.
    litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Affected: 0 , ≤ 2.0.7.2 (semver)
    		Create a notification for this product.
    princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player Affected: 0 , ≤ 2.0.82 (semver)
    		Create a notification for this product.
    spicethemes Carousel, Recent Post Slider and Banner Slider Affected: 0 , ≤ 2.1 (semver)
    		Create a notification for this product.
    pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) Affected: 0 , ≤ 2.1.0 (semver)
    		Create a notification for this product.
    xplodedthemes XT Quick View for WooCommerce Affected: 0 , ≤ 2.1.5 (semver)
    		Create a notification for this product.
    pluginscafe Smart phone field for Gravity Forms Affected: 0 , ≤ 2.1.6 (semver)
    		Create a notification for this product.
    fooplugins Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar Affected: 0 , ≤ 2.1.34 (semver)
    		Create a notification for this product.
    bplugins PDF Poster – Display PDF Files with Custom Viewer Affected: 0 , ≤ 2.2.0 (semver)
    		Create a notification for this product.
    nicheaddons Events Addon for Elementor Affected: 0 , ≤ 2.2.2 (semver)
    		Create a notification for this product.
    bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player Affected: 0 , ≤ 2.2.27 (semver)
    		Create a notification for this product.
    mte90 Glossary Affected: 0 , ≤ 2.2.38 (semver)
    		Create a notification for this product.
    tickera Restrict – membership, site, content and user access restrictions for WordPress Affected: 0 , ≤ 2.3.0 (semver)
    		Create a notification for this product.
    cyclonecode Custom PHP Settings Affected: 0 , ≤ 2.3.1 (semver)
    		Create a notification for this product.
    prasadkirpekar WP Meta and Date Remover Affected: 0 , ≤ 2.3.4 (semver)
    		Create a notification for this product.
    fullworks Anti-Spam Protection – No API Key, GDPR Friendly Affected: 0 , ≤ 2.3.7 (semver)
    		Create a notification for this product.
    premmerce Premmerce Permalink Manager for WooCommerce Affected: 0 , ≤ 2.3.11 (semver)
    		Create a notification for this product.
    smartwpress Music Player for Elementor – Audio Player & Podcast Player Affected: 0 , ≤ 2.4.1 (semver)
    		Create a notification for this product.
    mhmrajib TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More Affected: 0 , ≤ 2.4.1 (semver)
    		Create a notification for this product.
    oceanwp Ocean Extra Affected: 0 , ≤ 2.4.2 (semver)
    		Create a notification for this product.
    fooplugins Gallery by FooGallery Affected: 0 , ≤ 2.4.27 (semver)
    		Create a notification for this product.
    plugins360 Automatic YouTube Gallery Affected: 0 , ≤ 2.5.5 (semver)
    		Create a notification for this product.
    spiderdevs EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder Affected: 0 , ≤ 2.5.7 (semver)
    		Create a notification for this product.
    samdani Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More Affected: 0 , ≤ 2.5.8 (semver)
    		Create a notification for this product.
    tonyzeoli Radio Station by netmix® – Manage and play your Show Schedule in WordPress! Affected: 0 , ≤ 2.5.9 (semver)
    		Create a notification for this product.
    kaira StoreCustomizer – A plugin to Customize all WooCommerce Pages Affected: 0 , ≤ 2.5.9 (semver)
    		Create a notification for this product.
    wpjoli Joli Table Of Contents Affected: 0 , ≤ 2.6.0 (semver)
    		Create a notification for this product.
    passionatebrains GA4WP – Analytics Dashboard for the Website Affected: 0 , ≤ 2.6.0 (semver)
    		Create a notification for this product.
    nitin247 Place Order Without Payment for WooCommerce Affected: 0 , ≤ 2.6.5 (semver)
    		Create a notification for this product.
    wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages Affected: 0 , ≤ 2.6.7 (semver)
    		Create a notification for this product.
    mihail-barinov Share This Image Affected: 0 , ≤ 2.07 (semver)
    		Create a notification for this product.
    inavii Inavii Social Feed Affected: 0 , ≤ 2.7.0 (semver)
    		Create a notification for this product.
    fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox Affected: 0 , ≤ 2.7.33 (semver)
    		Create a notification for this product.
    xplodedthemes XT Floating Cart for WooCommerce Affected: 0 , ≤ 2.8.4 (semver)
    		Create a notification for this product.
    takanakui WP Mobile Menu – The Mobile-Friendly Responsive Menu Affected: 0 , ≤ 2.8.6 (semver)
    		Create a notification for this product.
    passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization Affected: 0 , ≤ 2.9.2 (semver)
    		Create a notification for this product.
    bensibley Independent Analytics Affected: 0 , ≤ 2.9.7 (semver)
    		Create a notification for this product.
    codesavory Knowledge Base documentation & wiki plugin – BasePress Docs Affected: 0 , ≤ 2.16.3.3 (semver)
    		Create a notification for this product.
    davidanderson Internal Link Juicer: SEO Auto Linker for WordPress Affected: 0 , ≤ 2.24.6 (semver)
    		Create a notification for this product.
    josevega Bulk Edit Posts and Products in Spreadsheet Affected: 0 , ≤ 2.25.16 (semver)
    		Create a notification for this product.
    saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Affected: 0 , ≤ 3.0.0 (semver)
    		Create a notification for this product.
    tobiasbg TablePress – Tables in WordPress made easy Affected: 0 , ≤ 3.0.2 (semver)
    		Create a notification for this product.
    bouncingsprout Ultimeter Affected: 0 , ≤ 3.0.5 (semver)
    		Create a notification for this product.
    blackandwhitedigital TreePress – Easy Family Trees & Ancestor Profiles Affected: 0 , ≤ 3.0.6 (semver)
    		Create a notification for this product.
    mattpramschufer Pay For Post with WooCommerce Affected: 0 , ≤ 3.1.26 (semver)
    		Create a notification for this product.
    koen12344 Post to Google My Business (Google Business Profile) Affected: 0 , ≤ 3.1.28 (semver)
    		Create a notification for this product.
    imtiazrayhan WP Coupons and Deals – Coupon Plugin For Affiliate Marketers Affected: 0 , ≤ 3.2.2 (semver)
    		Create a notification for this product.
    pluginsware Advanced Classifieds & Directory Pro Affected: 0 , ≤ 3.2.4 (semver)
    		Create a notification for this product.
    gallerycreator Mixed Media Gallery Blocks Affected: 0 , ≤ 3.2.4.4 (semver)
    		Create a notification for this product.
    blockspare BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor Affected: 0 , ≤ 3.2.6 (semver)
    		Create a notification for this product.
    mhmrajib AidWP – Donation & Payment Forms (Stripe Powered) Affected: 0 , ≤ 3.2.6 (semver)
    		Create a notification for this product.
    infornweb Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid Affected: 0 , ≤ 3.2.7 (semver)
    		Create a notification for this product.
    pluginandplay Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider Affected: 0 , ≤ 3.2.7 (semver)
    		Create a notification for this product.
    samdani Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews Affected: 0 , ≤ 3.2.8 (semver)
    		Create a notification for this product.
    wpspeedo Team Members Showcase Affected: 0 , ≤ 3.3.0 (semver)
    		Create a notification for this product.
    elespare EleSpare – News, Magazine and Blog Addons for Elementor Affected: 0 , ≤ 3.3.2 (semver)
    		Create a notification for this product.
    infornweb Post List Designer – Category Post, Recent Post, Post List Affected: 0 , ≤ 3.3.7 (semver)
    		Create a notification for this product.
    infornweb Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News Affected: 0 , ≤ 3.4.9 (semver)
    		Create a notification for this product.
    dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress Affected: 0 , ≤ 3.4.12 (semver)
    		Create a notification for this product.
    xplodedthemes WPIDE – File Manager & Code Editor Affected: 0 , ≤ 3.5.1 (semver)
    		Create a notification for this product.
    premmerce Premmerce Product Filter for WooCommerce Affected: 0 , ≤ 3.7.3 (semver)
    		Create a notification for this product.
    afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars Affected: 0 , ≤ 3.8.3 (semver)
    		Create a notification for this product.
    wpmagics Delete Posts automatically Affected: 0 , ≤ 3.9.6 (semver)
    		Create a notification for this product.
    takanakui Menu Image, Icons made easy Affected: 0 , ≤ 3.12 (semver)
    		Create a notification for this product.
    passionatebrains AWCA – The Great Analytics Insights for Your eStore Affected: 0 , ≤ 3.12.0 (semver)
    		Create a notification for this product.
    mikewire_rocksolid Announcement & Notification Banner – Bulletin Affected: 0 , ≤ 3.12.1 (semver)
    		Create a notification for this product.
    nitin247 Thank You Page for WooCommerce Affected: 0 , ≤ 4.2.0 (semver)
    		Create a notification for this product.
    webheadllc Contact Form 7 Multi-Step Forms Affected: 0 , ≤ 4.4.1 (semver)
    		Create a notification for this product.
    speedify Auto-Install Free SSL – Generate & Install Free SSL Certificates Affected: 0 , ≤ 4.5.0 (semver)
    		Create a notification for this product.
    mhmrajib WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes Affected: 0 , ≤ 4.6.8 (semver)
    		Create a notification for this product.
    webba-agency Easy Appointment Booking & Scheduling System – Webba Booking Calendar Affected: 0 , ≤ 5.0.57 (semver)
    		Create a notification for this product.
    invisnet WP fail2ban – Advanced Security Affected: 0 , ≤ 5.3.4 (semver)
    		Create a notification for this product.
    vinod-dalvi Ivory Search – WordPress Search Plugin Affected: 0 , ≤ 5.5.8 (semver)
    		Create a notification for this product.
    peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards Affected: 0 , ≤ 5.5.31 (semver)
    		Create a notification for this product.
    elliotvs Coupon Affiliates – Affiliate Plugin for WooCommerce Affected: 0 , ≤ 5.17.2 (semver)
    		Create a notification for this product.
    cleverplugins Security Ninja – WordPress Security & Firewall Affected: 0 , ≤ 5.222 (semver)
    		Create a notification for this product.
    theafricanboss Checkout with Cash App on WooCommerce Affected: 0 , ≤ 6.0.2 (semver)
    		Create a notification for this product.
    fullworks Display Eventbrite Events Affected: 0 , ≤ 6.1.10 (semver)
    		Create a notification for this product.
    mohsinoffline Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins Affected: 0 , ≤ 6.1.13 (semver)
    		Create a notification for this product.
    sjaved Easy Social Feed – Social Photos Gallery and Post Feed for WordPress Affected: 0 , ≤ 6.6.5 (semver)
    		Create a notification for this product.
    gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.3.3 (semver)
    		Create a notification for this product.
    gowebsmarty WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan Affected: 0 , ≤ 7.7.0 (semver)
    		Create a notification for this product.
    tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Affected: 0 , ≤ 8.0.7 (semver)
    		Create a notification for this product.
    Credits
    Asaf Mozes
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-01T13:23:14.835839Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-01T13:23:26.723Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Go Fetch Jobs (for WP Job Manager)",
          "vendor": "sebet",
          "versions": [
            {
              "lessThanOrEqual": "1.8.4.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dynamic Copyright Year",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Code Manager",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "1.0.40",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Scrollbar \u2013 Custom Scrollbar Styling and Behavior",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Goal Tracker \u2013 Custom Event Tracking for GA4",
          "vendor": "yuvalo",
          "versions": [
            {
              "lessThanOrEqual": "1.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent",
          "vendor": "essekia",
          "versions": [
            {
              "lessThanOrEqual": "1.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Page Templates",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "1.1.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Payment Gateway for ACBA BANK",
          "vendor": "hkdigitalagency",
          "versions": [
            {
              "lessThanOrEqual": "1.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dracula Dark Mode \u2013  Accessibility, Reading Mode \u0026 Dark Mode for WordPress",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "1.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Forumax \u2013 AI Powered Advanced Community Forum Plugin",
          "vendor": "spiderdevs",
          "versions": [
            {
              "lessThanOrEqual": "1.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Five-Star Ratings Shortcode",
          "vendor": "seezee",
          "versions": [
            {
              "lessThanOrEqual": "1.2.56",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Product Layouts for WooCommerce",
          "vendor": "oxilab",
          "versions": [
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Meta Field Block \u2013 Display custom fields in the Block Editor without coding",
          "vendor": "mr2p",
          "versions": [
            {
              "lessThanOrEqual": "1.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Custom WooCommerce Checkout Fields Editor",
          "vendor": "themelocation",
          "versions": [
            {
              "lessThanOrEqual": "1.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Open User Map",
          "vendor": "100plugins",
          "versions": [
            {
              "lessThanOrEqual": "1.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Notification Bell",
          "vendor": "wpdever",
          "versions": [
            {
              "lessThanOrEqual": "1.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Remove Add to Cart WooCommerce",
          "vendor": "themelocation",
          "versions": [
            {
              "lessThanOrEqual": "1.4.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "File Manager for Google Drive \u2013 Integrate Google Drive",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "1.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Marijuana Age Verify",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "RevivePress \u2013 Keep your Old Content Evergreen",
          "vendor": "infosatech",
          "versions": [
            {
              "lessThanOrEqual": "1.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Restaurant \u0026 Cafe Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "1.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Send Users Email \u2013 Email Subscribers, Email Marketing Newsletter",
          "vendor": "paretodigital",
          "versions": [
            {
              "lessThanOrEqual": "1.5.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Unlimited Elements For Elementor",
          "vendor": "unitecms",
          "versions": [
            {
              "lessThanOrEqual": "1.5.140",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Role Based Pricing for Woo by Meow Crew",
          "vendor": "meowcrew",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Primary Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Featured Images in RSS for Mailchimp \u0026 More",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Image Alt Text Manager \u2013 Bulk \u0026 Dynamic Alt Tags For image SEO Optimization + AI",
          "vendor": "wpsaad",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Message Filter for Contact Form 7",
          "vendor": "kofimokome",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Embedder for Google Reviews",
          "vendor": "paretodigital",
          "versions": [
            {
              "lessThanOrEqual": "1.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MapGeo \u2013 Interactive Geo Maps",
          "vendor": "interactivegeomaps",
          "versions": [
            {
              "lessThanOrEqual": "1.6.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WPBITS Addons For Elementor Page Builder",
          "vendor": "wpbits",
          "versions": [
            {
              "lessThanOrEqual": "1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Widgets on Pages",
          "vendor": "toddhalfpenny",
          "versions": [
            {
              "lessThanOrEqual": "1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spotlight Social Feeds \u2013 Block, Shortcode, and Widget",
          "vendor": "rebelcode",
          "versions": [
            {
              "lessThanOrEqual": "1.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms",
          "vendor": "tobias_conrad",
          "versions": [
            {
              "lessThanOrEqual": "1.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AI Bud \u2013 AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o",
          "vendor": "webfactory",
          "versions": [
            {
              "lessThanOrEqual": "1.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Text To Speech TTS Accessibility",
          "vendor": "hasanazizul",
          "versions": [
            {
              "lessThanOrEqual": "1.7.34",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Age Verify",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AI Puffer \u2013 Chat. Create. Automate. (formerly AI Power)",
          "vendor": "senols",
          "versions": [
            {
              "lessThanOrEqual": "1.8.99",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Justified Gallery",
          "vendor": "damian-gora",
          "versions": [
            {
              "lessThanOrEqual": "1.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mapster WP Maps",
          "vendor": "mapster",
          "versions": [
            {
              "lessThanOrEqual": "1.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "StreamWeasels Twitch Integration",
          "vendor": "streamweasels",
          "versions": [
            {
              "lessThanOrEqual": "1.9.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Variation Swatches for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "1.9.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "bBlocks \u2013 Essential Gutenberg Blocks \u0026 Patterns Collection",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.9.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "URL Shortify \u2013 Simple and Easy URL Shortener",
          "vendor": "kaizencoders",
          "versions": [
            {
              "lessThanOrEqual": "1.10.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Kikote \u2013 Location Picker at Checkout \u0026 Google Address AutoFill Plugin for WooCommerce",
          "vendor": "uriahs-victor",
          "versions": [
            {
              "lessThanOrEqual": "1.10.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Geo Mashup",
          "vendor": "cyberhobo",
          "versions": [
            {
              "lessThanOrEqual": "1.13.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Disable Payment Methods based on cart conditions for WooCommerce",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "1.16.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Automatic Internal Links for SEO by Pagup",
          "vendor": "pagup",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Full Screen Background",
          "vendor": "enweby",
          "versions": [
            {
              "lessThanOrEqual": "2.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder \u0026 Template Kits",
          "vendor": "litonice13",
          "versions": [
            {
              "lessThanOrEqual": "2.0.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "2.0.82",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Carousel, Recent Post Slider and Banner Slider",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)",
          "vendor": "pagup",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Quick View for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Smart phone field for Gravity Forms",
          "vendor": "pluginscafe",
          "versions": [
            {
              "lessThanOrEqual": "2.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Notification Bar, Announcement and Cookie Notice WordPress Plugin \u2013 FooBar",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.1.34",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PDF Poster \u2013 Display PDF Files with Custom Viewer",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Events Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 \u0026 Audio Player",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.2.27",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Glossary",
          "vendor": "mte90",
          "versions": [
            {
              "lessThanOrEqual": "2.2.38",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Restrict \u2013 membership, site, content and user access restrictions for WordPress",
          "vendor": "tickera",
          "versions": [
            {
              "lessThanOrEqual": "2.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Custom PHP Settings",
          "vendor": "cyclonecode",
          "versions": [
            {
              "lessThanOrEqual": "2.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Meta and Date Remover",
          "vendor": "prasadkirpekar",
          "versions": [
            {
              "lessThanOrEqual": "2.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Anti-Spam Protection \u2013 No API Key, GDPR Friendly",
          "vendor": "fullworks",
          "versions": [
            {
              "lessThanOrEqual": "2.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Premmerce Permalink Manager for WooCommerce",
          "vendor": "premmerce",
          "versions": [
            {
              "lessThanOrEqual": "2.3.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Music Player for Elementor \u2013 Audio Player \u0026 Podcast Player",
          "vendor": "smartwpress",
          "versions": [
            {
              "lessThanOrEqual": "2.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TopNewsWp \u2013 Display Tikcer News, RSS Feed Widget and Many More",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "2.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ocean Extra",
          "vendor": "oceanwp",
          "versions": [
            {
              "lessThanOrEqual": "2.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Gallery by FooGallery",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.4.27",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Automatic YouTube Gallery",
          "vendor": "plugins360",
          "versions": [
            {
              "lessThanOrEqual": "2.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation \u0026 FAQ Builder",
          "vendor": "spiderdevs",
          "versions": [
            {
              "lessThanOrEqual": "2.5.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Team Members \u2013 A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More",
          "vendor": "samdani",
          "versions": [
            {
              "lessThanOrEqual": "2.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!",
          "vendor": "tonyzeoli",
          "versions": [
            {
              "lessThanOrEqual": "2.5.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "StoreCustomizer \u2013 A plugin to Customize all WooCommerce Pages",
          "vendor": "kaira",
          "versions": [
            {
              "lessThanOrEqual": "2.5.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Joli Table Of Contents",
          "vendor": "wpjoli",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GA4WP \u2013 Analytics Dashboard for the Website",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Place Order Without Payment for WooCommerce",
          "vendor": "nitin247",
          "versions": [
            {
              "lessThanOrEqual": "2.6.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Better Messages \u2013 Live Chat, Chat Rooms, Real-Time Messaging \u0026 Private Messages",
          "vendor": "wordplus",
          "versions": [
            {
              "lessThanOrEqual": "2.6.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Share This Image",
          "vendor": "mihail-barinov",
          "versions": [
            {
              "lessThanOrEqual": "2.07",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Inavii Social Feed",
          "vendor": "inavii",
          "versions": [
            {
              "lessThanOrEqual": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Lightbox \u0026 Modal Popup WordPress Plugin \u2013 FooBox",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.7.33",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Floating Cart for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "2.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu",
          "vendor": "takanakui",
          "versions": [
            {
              "lessThanOrEqual": "2.8.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading \u0026 Image Optimization",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "2.9.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Independent Analytics",
          "vendor": "bensibley",
          "versions": [
            {
              "lessThanOrEqual": "2.9.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Knowledge Base documentation \u0026 wiki plugin \u2013 BasePress Docs",
          "vendor": "codesavory",
          "versions": [
            {
              "lessThanOrEqual": "2.16.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Internal Link Juicer: SEO Auto Linker for WordPress",
          "vendor": "davidanderson",
          "versions": [
            {
              "lessThanOrEqual": "2.24.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Bulk Edit Posts and Products in Spreadsheet",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "2.25.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TablePress \u2013 Tables in WordPress made easy",
          "vendor": "tobiasbg",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ultimeter",
          "vendor": "bouncingsprout",
          "versions": [
            {
              "lessThanOrEqual": "3.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TreePress \u2013 Easy Family Trees \u0026 Ancestor Profiles",
          "vendor": "blackandwhitedigital",
          "versions": [
            {
              "lessThanOrEqual": "3.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Pay For Post with WooCommerce",
          "vendor": "mattpramschufer",
          "versions": [
            {
              "lessThanOrEqual": "3.1.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post to Google My Business (Google Business Profile)",
          "vendor": "koen12344",
          "versions": [
            {
              "lessThanOrEqual": "3.1.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Coupons and Deals \u2013 Coupon Plugin For Affiliate Marketers",
          "vendor": "imtiazrayhan",
          "versions": [
            {
              "lessThanOrEqual": "3.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Classifieds \u0026 Directory Pro",
          "vendor": "pluginsware",
          "versions": [
            {
              "lessThanOrEqual": "3.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mixed Media Gallery Blocks",
          "vendor": "gallerycreator",
          "versions": [
            {
              "lessThanOrEqual": "3.2.4.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "BlockSpare \u2014 News, Magazine and Blog Addons for (Gutenberg) Block Editor",
          "vendor": "blockspare",
          "versions": [
            {
              "lessThanOrEqual": "3.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AidWP \u2013 Donation \u0026 Payment Forms (Stripe Powered)",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "3.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider \u0026 Logo Grid",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post Slider and Post Carousel with Post Vertical Scrolling Widget \u2013 A Responsive Post Slider",
          "vendor": "pluginandplay",
          "versions": [
            {
              "lessThanOrEqual": "3.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Solid Testimonials \u2013 Testimonial Slider, Video Testimonials \u0026 Customer Reviews",
          "vendor": "samdani",
          "versions": [
            {
              "lessThanOrEqual": "3.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Team Members Showcase",
          "vendor": "wpspeedo",
          "versions": [
            {
              "lessThanOrEqual": "3.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EleSpare \u2013 News, Magazine and Blog Addons for Elementor",
          "vendor": "elespare",
          "versions": [
            {
              "lessThanOrEqual": "3.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post List Designer \u2013 Category Post, Recent Post, Post List",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "YASR \u2013 Yet Another Star Rating Plugin for WordPress",
          "vendor": "dashlabsltd",
          "versions": [
            {
              "lessThanOrEqual": "3.4.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WPIDE \u2013 File Manager \u0026 Code Editor",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "3.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Premmerce Product Filter for WooCommerce",
          "vendor": "premmerce",
          "versions": [
            {
              "lessThanOrEqual": "3.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors \u0026 Custom Avatars",
          "vendor": "afthemes",
          "versions": [
            {
              "lessThanOrEqual": "3.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Delete Posts automatically",
          "vendor": "wpmagics",
          "versions": [
            {
              "lessThanOrEqual": "3.9.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Menu Image, Icons made easy",
          "vendor": "takanakui",
          "versions": [
            {
              "lessThanOrEqual": "3.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AWCA \u2013 The Great Analytics Insights for Your eStore",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "3.12.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Announcement \u0026 Notification Banner \u2013 Bulletin",
          "vendor": "mikewire_rocksolid",
          "versions": [
            {
              "lessThanOrEqual": "3.12.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Thank You Page for WooCommerce",
          "vendor": "nitin247",
          "versions": [
            {
              "lessThanOrEqual": "4.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Contact Form 7 Multi-Step Forms",
          "vendor": "webheadllc",
          "versions": [
            {
              "lessThanOrEqual": "4.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Auto-Install Free SSL \u2013 Generate \u0026 Install Free SSL Certificates",
          "vendor": "speedify",
          "versions": [
            {
              "lessThanOrEqual": "4.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Books Gallery \u2013 Build Stunning Book Showcases \u0026 Libraries in Minutes",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "4.6.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Appointment Booking \u0026 Scheduling System \u2013 Webba Booking Calendar",
          "vendor": "webba-agency",
          "versions": [
            {
              "lessThanOrEqual": "5.0.57",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP fail2ban \u2013 Advanced Security",
          "vendor": "invisnet",
          "versions": [
            {
              "lessThanOrEqual": "5.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ivory Search \u2013 WordPress Search Plugin",
          "vendor": "vinod-dalvi",
          "versions": [
            {
              "lessThanOrEqual": "5.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps \u0026 Dashboards",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.31",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce",
          "vendor": "elliotvs",
          "versions": [
            {
              "lessThanOrEqual": "5.17.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Security Ninja \u2013 WordPress Security \u0026 Firewall",
          "vendor": "cleverplugins",
          "versions": [
            {
              "lessThanOrEqual": "5.222",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Checkout with Cash App on WooCommerce",
          "vendor": "theafricanboss",
          "versions": [
            {
              "lessThanOrEqual": "6.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Display Eventbrite Events",
          "vendor": "fullworks",
          "versions": [
            {
              "lessThanOrEqual": "6.1.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins",
          "vendor": "mohsinoffline",
          "versions": [
            {
              "lessThanOrEqual": "6.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Social Feed \u2013 Social Photos Gallery and Post Feed for WordPress",
          "vendor": "sjaved",
          "versions": [
            {
              "lessThanOrEqual": "6.6.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Encryption \u2013 One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan",
          "vendor": "gowebsmarty",
          "versions": [
            {
              "lessThanOrEqual": "7.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto",
          "vendor": "tripetto",
          "versions": [
            {
              "lessThanOrEqual": "8.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asaf Mozes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-01T05:29:54.148Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3235286/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3249130/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3229060/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-30T17:32:32.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-04-30T17:17:30.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Freemius \u003c= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-13362",
    "datePublished": "2026-05-01T05:29:54.148Z",
    "dateReserved": "2025-01-13T18:08:47.439Z",
    "dateUpdated": "2026-05-01T13:23:26.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-3090 (GCVE-0-2026-3090)

    Vulnerability from nvd – Published: 2026-03-18 15:28 – Updated: 2026-04-08 16:48
    VLAI
    Title
    Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'
    Summary
    The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_type’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when the Post SMTP Pro plugin is also installed and its Reporting and Tracking extension is enabled.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-03-18 17:01 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Phú
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3090",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-18T17:01:09.399609Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T17:02:50.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ph\u00fa"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018event_type\u2019 parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when the Post SMTP Pro plugin is also installed and its Reporting and Tracking extension is enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:48:13.127Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8cbbbb-2089-4966-8fd3-da4f76fb2517?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/PostmanEmailLogs.php#L459"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3484515/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-24T01:52:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-03-17T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via \u0027event_type\u0027"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-3090",
    "datePublished": "2026-03-18T15:28:29.140Z",
    "dateReserved": "2026-02-24T01:24:00.305Z",
    "dateUpdated": "2026-04-08T16:48:13.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-2559 (GCVE-0-2026-2559)

    Vulnerability from nvd – Published: 2026-03-18 15:28 – Updated: 2026-04-08 16:45
    VLAI
    Title
    Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite
    Summary
    The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `handle_office365_oauth_redirect()` function in all versions up to, and including, 3.8.0. This is due to the function being hooked to `admin_init` without any `current_user_can()` check or nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the site's Office 365 OAuth mail configuration (access token, refresh token, and user email) via a crafted URL. The configuration option is used during wizard setup of Microsoft365 SMTP, only available in the Pro option of the plugin. This could cause an Administrator to believe an attacker-controlled Azure app is their own, and lead them to connect the plugin to the attacker's account during configuration after upgrading to Pro.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-03-18 17:06 UTC
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Michael Iden
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2559",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-18T17:06:23.958716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T17:06:32.930Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Iden"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `handle_office365_oauth_redirect()` function in all versions up to, and including, 3.8.0. This is due to the function being hooked to `admin_init` without any `current_user_can()` check or nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the site\u0027s Office 365 OAuth mail configuration (access token, refresh token, and user email) via a crafted URL. The configuration option is used during wizard setup of Microsoft365 SMTP, only available in the Pro option of the plugin. This could cause an Administrator to believe an attacker-controlled Azure app is their own, and lead them to connect the plugin to the attacker\u0027s account during configuration after upgrading to Pro."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:45:16.533Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/323436b5-fbfe-4923-8b08-93c1fcabc016?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L2109"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L104"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3484515/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-15T19:21:39.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-03-17T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-2559",
    "datePublished": "2026-03-18T15:28:28.190Z",
    "dateReserved": "2026-02-15T19:05:42.476Z",
    "dateUpdated": "2026-04-08T16:45:16.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-12887 (GCVE-0-2025-12887)

    Vulnerability from nvd – Published: 2025-12-03 12:29 – Updated: 2026-04-08 16:55
    VLAI
    Title
    Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update
    Summary
    The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the 'handle_gmail_oauth_redirect' function. This makes it possible for authenticated attackers, with subscriber level access and above, to inject invalid or attacker-controlled OAuth credentials. CVE-2025-67563 appears to be a duplicate of this issue.
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-12-03 14:09 UTC
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    M Indra Purnama
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12887",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-03T14:09:06.643764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-03T14:09:43.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "M Indra Purnama"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the \u0027handle_gmail_oauth_redirect\u0027 function. This makes it possible for authenticated attackers, with subscriber level access and above, to inject invalid or attacker-controlled OAuth credentials. CVE-2025-67563 appears to be a duplicate of this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:55:27.472Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd9f312-99e1-4dc2-855d-90339c2e24da?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3402203"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-01T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2025-11-07T17:45:14.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-12-03T00:22:23.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP \u0026 Mobile App \u003c= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-12887",
    "datePublished": "2025-12-03T12:29:53.626Z",
    "dateReserved": "2025-11-07T17:28:03.418Z",
    "dateUpdated": "2026-04-08T16:55:27.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-11833 (GCVE-0-2025-11833)

    Vulnerability from nvd – Published: 2025-11-01 03:34 – Updated: 2026-04-08 16:50
    VLAI
    Title
    Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure
    Summary
    The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-11-03 15:47 UTC
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Carl Pearson
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11833",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-03T15:47:14.968225Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-03T15:47:23.380Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Carl Pearson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP \u0026 Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:50:24.214Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/491f44fc-712c-4f67-b5c2-a7396941afc1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/tags/3.5.0/Postman/PostmanEmailLogs.php#L51"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3386160/post-smtp"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-15T19:30:48.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-10-31T14:46:56.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP \u0026 Mobile App \u003c= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-11833",
    "datePublished": "2025-11-01T03:34:35.794Z",
    "dateReserved": "2025-10-15T19:10:23.277Z",
    "dateUpdated": "2026-04-08T16:50:24.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-9219 (GCVE-0-2025-9219)

    Vulnerability from nvd – Published: 2025-09-03 08:27 – Updated: 2026-04-08 16:57
    VLAI
    Title
    Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update
    Summary
    The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback' function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-09-03 13:27 UTC
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Matteo Leonelli David Dewes
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-03T13:27:13.724015Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-03T13:27:25.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Leonelli"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "David Dewes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP \u2013 WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications \u2013 Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027update_post_smtp_pro_option_callback\u0027 function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:57:49.947Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/65914bbf-6563-4bf2-a358-885e182a1365?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L1858"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3353624/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-20T17:23:11.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-09-02T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-9219",
    "datePublished": "2025-09-03T08:27:23.212Z",
    "dateReserved": "2025-08-19T23:24:12.546Z",
    "dateUpdated": "2026-04-08T16:57:49.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-13844 (GCVE-0-2024-13844)

    Vulnerability from nvd – Published: 2025-03-08 05:30 – Updated: 2026-04-08 16:33
    VLAI
    Title
    Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter
    Summary
    The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
    Severity
    4.9 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-03-10 14:49 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Nhien Pham
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13844",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T14:49:49.092247Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-12T15:32:37.834Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nhien Pham"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the \u2018columns\u2019 parameter in all versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:33:21.343Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0540f70d-009a-4776-8717-f096e30a11d3?source=cve"
        },
        {
          "url": "https://gist.github.com/nhienit2010/d4692062f54b89e16aa068a0ef142cf6#file-postmanemailquerylog-php-L314"
        },
        {
          "url": "https://wordpress.org/plugins/post-smtp/#developers"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3249371/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-07T16:21:23.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-13844",
    "datePublished": "2025-03-08T05:30:08.283Z",
    "dateReserved": "2025-02-06T20:11:02.474Z",
    "dateUpdated": "2026-04-08T16:33:21.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-0521 (GCVE-0-2025-0521)

    Vulnerability from nvd – Published: 2025-02-18 11:10 – Updated: 2026-04-08 16:46
    VLAI
    Title
    Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting
    Summary
    The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-02-18 14:26 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    D.Sim
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0521",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T14:26:02.492087Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T14:26:27.507Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "D.Sim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:46:08.793Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/366dfbf1-870c-4ce3-abc4-a2b2f4e72175?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3237626%40post-smtp%2Ftrunk\u0026old=3229076%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-02-17T22:24:21.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 3.0.2 - Unauthenticated Stored Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-0521",
    "datePublished": "2025-02-18T11:10:18.504Z",
    "dateReserved": "2025-01-16T17:53:46.524Z",
    "dateUpdated": "2026-04-08T16:46:08.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-5207 (GCVE-0-2024-5207)

    Vulnerability from nvd – Published: 2024-05-30 05:33 – Updated: 2026-04-08 16:35
    VLAI
    Title
    POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection
    Summary
    The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the selected parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator access or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-05-30 14:22 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    ngocanh le
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5207",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-30T14:22:11.126597Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:02:40.236Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:03:11.068Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/103db583-9399-4a45-a316-808b55fc6a6c?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Postman-Email-Log/PostmanEmailQueryLog.php?rev=2974258#L262"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3094453%40post-smtp%2Ftrunk\u0026old=3090744%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ngocanh le"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The POST SMTP \u2013 The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the selected parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers with administrator access or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:35:56.097Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/103db583-9399-4a45-a316-808b55fc6a6c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Postman-Email-Log/PostmanEmailQueryLog.php?rev=2974258#L262"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3094453%40post-smtp%2Ftrunk\u0026old=3090744%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-05-22T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \u003c= 2.9.3 - Authenticated (Administrator+) SQL Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-5207",
    "datePublished": "2024-05-30T05:33:15.366Z",
    "dateReserved": "2024-05-22T16:28:30.293Z",
    "dateUpdated": "2026-04-08T16:35:56.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-6875 (GCVE-0-2023-6875)

    Vulnerability from nvd – Published: 2024-01-11 08:33 – Updated: 2026-04-08 17:30
    VLAI Shadowserver Previdian
    Title
    POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
    Summary
    The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-05-08 15:41 UTC
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    • CWE-862 - Missing Authorization
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Ulyses Saicha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:42:08.006Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L60"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk?contextall=1\u0026old=3012318\u0026old_path=%2Fpost-smtp%2Ftrunk"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/176525/WordPress-POST-SMTP-Mailer-2.8.7-Authorization-Bypass-Cross-Site-Scripting.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:41:09.652845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:08:33.781Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.8.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ulyses Saicha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:30:11.388Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L60"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk?contextall=1\u0026old=3012318\u0026old_path=%2Fpost-smtp%2Ftrunk"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-01-10T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \u003c= 2.8.7 - Authorization Bypass via type connect-app API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-6875",
    "datePublished": "2024-01-11T08:33:06.214Z",
    "dateReserved": "2023-12-15T18:36:38.930Z",
    "dateUpdated": "2026-04-08T17:30:11.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-7027 (GCVE-0-2023-7027)

    Vulnerability from nvd – Published: 2024-01-03 04:29 – Updated: 2026-04-08 17:03
    VLAI
    Title
    POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device
    Summary
    The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ header in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-11-14 18:41 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Sean Murphy
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:50:08.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8911a3-ce0f-420c-bf2a-1c2929d01cef?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L79"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/mobile.php#L219"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3016126%40post-smtp%2Ftrunk\u0026old=3012318%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/176525/WordPress-POST-SMTP-Mailer-2.8.7-Authorization-Bypass-Cross-Site-Scripting.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-7027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-14T18:41:09.897882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-14T18:41:25.143Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.8.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sean Murphy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018device\u2019 header in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:03:10.198Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8911a3-ce0f-420c-bf2a-1c2929d01cef?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L79"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/mobile.php#L219"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3016126%40post-smtp%2Ftrunk\u0026old=3012318%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-01-02T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \u003c= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-7027",
    "datePublished": "2024-01-03T04:29:34.469Z",
    "dateReserved": "2023-12-20T18:53:20.908Z",
    "dateUpdated": "2026-04-08T17:03:10.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-6629 (GCVE-0-2023-6629)

    Vulnerability from nvd – Published: 2024-01-03 04:29 – Updated: 2026-04-08 17:01
    VLAI
    Title
    POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg
    Summary
    The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-6621 appears to be a duplicate of this issue. CVE-2024-29128 appears to be a duplicate of this issue.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-01-08 20:37 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Matan Berson
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:35:14.828Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7681f984-d488-4da7-afe1-988e5ad012f2?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L396"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3012318%40post-smtp%2Ftrunk\u0026old=3006604%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail=#file4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6629",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-08T20:37:11.497261Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T20:29:08.485Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.8.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matan Berson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018msg\u2019 parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-6621 appears to be a duplicate of this issue. CVE-2024-29128 appears to be a duplicate of this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:01:31.782Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7681f984-d488-4da7-afe1-988e5ad012f2?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L396"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3012318%40post-smtp%2Ftrunk\u0026old=3006604%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail=#file4"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-01-02T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "POST SMTP Mailer \u003c= 2.8.6 - Reflected Cross-Site Scripting via msg"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-6629",
    "datePublished": "2024-01-03T04:29:33.793Z",
    "dateReserved": "2023-12-08T16:05:50.184Z",
    "dateUpdated": "2026-04-08T17:01:31.782Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2021-4422 (GCVE-0-2021-4422)

    Vulnerability from nvd – Published: 2023-07-12 06:52 – Updated: 2026-04-08 17:28
    VLAI
    Title
    POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass
    Summary
    The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-10-21 18:10 UTC
    CWE
    • CWE-352 - Cross-Site Request Forgery (CSRF)
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Jerome Bruandet
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:23:10.780Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e018ca7c-06dd-4d40-91d4-4ed188b8aaf2?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2473579%40post-smtp\u0026new=2473579%40post-smtp\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-4422",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T18:10:26.067174Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T18:10:38.184Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.0.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jerome Bruandet"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:28:38.403Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e018ca7c-06dd-4d40-91d4-4ed188b8aaf2?source=cve"
        },
        {
          "url": "https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/"
        },
        {
          "url": "https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/"
        },
        {
          "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/"
        },
        {
          "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/"
        },
        {
          "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/"
        },
        {
          "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/"
        },
        {
          "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2473579%40post-smtp\u0026new=2473579%40post-smtp\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2021-03-01T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "POST SMTP Mailer \u003c= 2.0.20 - Cross-Site Request Forgery Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2021-4422",
    "datePublished": "2023-07-12T06:52:35.453Z",
    "dateReserved": "2023-07-11T18:37:13.653Z",
    "dateUpdated": "2026-04-08T17:28:38.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-3082 (GCVE-0-2023-3082)

    Vulnerability from nvd – Published: 2023-07-12 04:38 – Updated: 2026-04-08 16:59
    VLAI
    Title
    Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email
    Summary
    The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-02-05 18:38 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Alex Thomas
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:41:04.212Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ecd0fa6-4fdb-4780-9560-0bb126800685?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/2935537/post-smtp"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3082",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-05T18:38:23.734298Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T19:40:54.881Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.5.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alex Thomas"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:59:46.955Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ecd0fa6-4fdb-4780-9560-0bb126800685?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/2935537/post-smtp"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-02T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2023-06-05T00:00:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2023-07-11T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-3082",
    "datePublished": "2023-07-12T04:38:45.662Z",
    "dateReserved": "2023-06-03T03:15:56.101Z",
    "dateUpdated": "2026-04-08T16:59:46.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-13362 (GCVE-0-2024-13362)

    Vulnerability from cvelistv5 – Published: 2026-05-01 05:29 – Updated: 2026-05-01 13:23
    VLAI
    Title
    Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
    Summary
    Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-01 13:23 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    sebet Go Fetch Jobs (for WP Job Manager) Affected: 0 , ≤ 1.8.4.8.1 (semver)
    		Create a notification for this product.
    5starplugins Dynamic Copyright Year Affected: 0 , ≤ 1.0.4 (semver)
    		Create a notification for this product.
    peterschulznl Code Manager Affected: 0 , ≤ 1.0.40 (semver)
    		Create a notification for this product.
    bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior Affected: 0 , ≤ 1.1.3 (semver)
    		Create a notification for this product.
    yuvalo Goal Tracker – Custom Event Tracking for GA4 Affected: 0 , ≤ 1.1.5 (semver)
    		Create a notification for this product.
    essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent Affected: 0 , ≤ 1.1.13 (semver)
    		Create a notification for this product.
    josevega WP Page Templates Affected: 0 , ≤ 1.1.16 (semver)
    		Create a notification for this product.
    hkdigitalagency Payment Gateway for ACBA BANK Affected: 0 , ≤ 1.2.6 (semver)
    		Create a notification for this product.
    princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress Affected: 0 , ≤ 1.2.7 (semver)
    		Create a notification for this product.
    spiderdevs Forumax – AI Powered Advanced Community Forum Plugin Affected: 0 , ≤ 1.2.7 (semver)
    		Create a notification for this product.
    seezee Five-Star Ratings Shortcode Affected: 0 , ≤ 1.2.56 (semver)
    		Create a notification for this product.
    oxilab Product Layouts for WooCommerce Affected: 0 , ≤ 1.3.1 (semver)
    		Create a notification for this product.
    mr2p Meta Field Block – Display custom fields in the Block Editor without coding Affected: 0 , ≤ 1.3.3 (semver)
    		Create a notification for this product.
    themelocation Custom WooCommerce Checkout Fields Editor Affected: 0 , ≤ 1.3.4 (semver)
    		Create a notification for this product.
    100plugins Open User Map Affected: 0 , ≤ 1.4.0 (semver)
    		Create a notification for this product.
    wpdever WP Notification Bell Affected: 0 , ≤ 1.4.2 (semver)
    		Create a notification for this product.
    themelocation Remove Add to Cart WooCommerce Affected: 0 , ≤ 1.4.7 (semver)
    		Create a notification for this product.
    princeahmed File Manager for Google Drive – Integrate Google Drive Affected: 0 , ≤ 1.4.9 (semver)
    		Create a notification for this product.
    5starplugins Marijuana Age Verify Affected: 0 , ≤ 1.5.5 (semver)
    		Create a notification for this product.
    infosatech RevivePress – Keep your Old Content Evergreen Affected: 0 , ≤ 1.5.8 (semver)
    		Create a notification for this product.
    nicheaddons Restaurant & Cafe Addon for Elementor Affected: 0 , ≤ 1.5.8 (semver)
    		Create a notification for this product.
    paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter Affected: 0 , ≤ 1.5.10 (semver)
    		Create a notification for this product.
    unitecms Unlimited Elements For Elementor Affected: 0 , ≤ 1.5.140 (semver)
    		Create a notification for this product.
    meowcrew Role Based Pricing for Woo by Meow Crew Affected: 0 , ≤ 1.6.0 (semver)
    		Create a notification for this product.
    nicheaddons Primary Addon for Elementor Affected: 0 , ≤ 1.6.0 (semver)
    		Create a notification for this product.
    5starplugins Featured Images in RSS for Mailchimp & More Affected: 0 , ≤ 1.6.3 (semver)
    		Create a notification for this product.
    wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI Affected: 0 , ≤ 1.6.3 (semver)
    		Create a notification for this product.
    kofimokome Message Filter for Contact Form 7 Affected: 0 , ≤ 1.6.3.2 (semver)
    		Create a notification for this product.
    paretodigital Embedder for Google Reviews Affected: 0 , ≤ 1.6.6 (semver)
    		Create a notification for this product.
    interactivegeomaps MapGeo – Interactive Geo Maps Affected: 0 , ≤ 1.6.22 (semver)
    		Create a notification for this product.
    wpbits WPBITS Addons For Elementor Page Builder Affected: 0 , ≤ 1.7 (semver)
    		Create a notification for this product.
    toddhalfpenny Widgets on Pages Affected: 0 , ≤ 1.7 (semver)
    		Create a notification for this product.
    rebelcode Spotlight Social Feeds – Block, Shortcode, and Widget Affected: 0 , ≤ 1.7.0 (semver)
    		Create a notification for this product.
    tobias_conrad WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms Affected: 0 , ≤ 1.7.0 (semver)
    		Create a notification for this product.
    webfactory AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o Affected: 0 , ≤ 1.7.2 (semver)
    		Create a notification for this product.
    hasanazizul Text To Speech TTS Accessibility Affected: 0 , ≤ 1.7.34 (semver)
    		Create a notification for this product.
    5starplugins Easy Age Verify Affected: 0 , ≤ 1.8.5 (semver)
    		Create a notification for this product.
    senols AI Puffer – Chat. Create. Automate. (formerly AI Power) Affected: 0 , ≤ 1.8.99 (semver)
    		Create a notification for this product.
    damian-gora Justified Gallery Affected: 0 , ≤ 1.9.0 (semver)
    		Create a notification for this product.
    mapster Mapster WP Maps Affected: 0 , ≤ 1.9.0 (semver)
    		Create a notification for this product.
    streamweasels StreamWeasels Twitch Integration Affected: 0 , ≤ 1.9.2 (semver)
    		Create a notification for this product.
    xplodedthemes XT Variation Swatches for WooCommerce Affected: 0 , ≤ 1.9.4 (semver)
    		Create a notification for this product.
    bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection Affected: 0 , ≤ 1.9.8 (semver)
    		Create a notification for this product.
    kaizencoders URL Shortify – Simple and Easy URL Shortener Affected: 0 , ≤ 1.10.4 (semver)
    		Create a notification for this product.
    uriahs-victor Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce Affected: 0 , ≤ 1.10.6 (semver)
    		Create a notification for this product.
    cyberhobo Geo Mashup Affected: 0 , ≤ 1.13.15 (semver)
    		Create a notification for this product.
    josevega Disable Payment Methods based on cart conditions for WooCommerce Affected: 0 , ≤ 1.16.3 (semver)
    		Create a notification for this product.
    pagup Automatic Internal Links for SEO by Pagup Affected: 0 , ≤ 2.0.0 (semver)
    		Create a notification for this product.
    enweby Full Screen Background Affected: 0 , ≤ 2.0.2 (semver)
    		Create a notification for this product.
    litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Affected: 0 , ≤ 2.0.7.2 (semver)
    		Create a notification for this product.
    princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player Affected: 0 , ≤ 2.0.82 (semver)
    		Create a notification for this product.
    spicethemes Carousel, Recent Post Slider and Banner Slider Affected: 0 , ≤ 2.1 (semver)
    		Create a notification for this product.
    pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) Affected: 0 , ≤ 2.1.0 (semver)
    		Create a notification for this product.
    xplodedthemes XT Quick View for WooCommerce Affected: 0 , ≤ 2.1.5 (semver)
    		Create a notification for this product.
    pluginscafe Smart phone field for Gravity Forms Affected: 0 , ≤ 2.1.6 (semver)
    		Create a notification for this product.
    fooplugins Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar Affected: 0 , ≤ 2.1.34 (semver)
    		Create a notification for this product.
    bplugins PDF Poster – Display PDF Files with Custom Viewer Affected: 0 , ≤ 2.2.0 (semver)
    		Create a notification for this product.
    nicheaddons Events Addon for Elementor Affected: 0 , ≤ 2.2.2 (semver)
    		Create a notification for this product.
    bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player Affected: 0 , ≤ 2.2.27 (semver)
    		Create a notification for this product.
    mte90 Glossary Affected: 0 , ≤ 2.2.38 (semver)
    		Create a notification for this product.
    tickera Restrict – membership, site, content and user access restrictions for WordPress Affected: 0 , ≤ 2.3.0 (semver)
    		Create a notification for this product.
    cyclonecode Custom PHP Settings Affected: 0 , ≤ 2.3.1 (semver)
    		Create a notification for this product.
    prasadkirpekar WP Meta and Date Remover Affected: 0 , ≤ 2.3.4 (semver)
    		Create a notification for this product.
    fullworks Anti-Spam Protection – No API Key, GDPR Friendly Affected: 0 , ≤ 2.3.7 (semver)
    		Create a notification for this product.
    premmerce Premmerce Permalink Manager for WooCommerce Affected: 0 , ≤ 2.3.11 (semver)
    		Create a notification for this product.
    smartwpress Music Player for Elementor – Audio Player & Podcast Player Affected: 0 , ≤ 2.4.1 (semver)
    		Create a notification for this product.
    mhmrajib TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More Affected: 0 , ≤ 2.4.1 (semver)
    		Create a notification for this product.
    oceanwp Ocean Extra Affected: 0 , ≤ 2.4.2 (semver)
    		Create a notification for this product.
    fooplugins Gallery by FooGallery Affected: 0 , ≤ 2.4.27 (semver)
    		Create a notification for this product.
    plugins360 Automatic YouTube Gallery Affected: 0 , ≤ 2.5.5 (semver)
    		Create a notification for this product.
    spiderdevs EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder Affected: 0 , ≤ 2.5.7 (semver)
    		Create a notification for this product.
    samdani Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More Affected: 0 , ≤ 2.5.8 (semver)
    		Create a notification for this product.
    tonyzeoli Radio Station by netmix® – Manage and play your Show Schedule in WordPress! Affected: 0 , ≤ 2.5.9 (semver)
    		Create a notification for this product.
    kaira StoreCustomizer – A plugin to Customize all WooCommerce Pages Affected: 0 , ≤ 2.5.9 (semver)
    		Create a notification for this product.
    wpjoli Joli Table Of Contents Affected: 0 , ≤ 2.6.0 (semver)
    		Create a notification for this product.
    passionatebrains GA4WP – Analytics Dashboard for the Website Affected: 0 , ≤ 2.6.0 (semver)
    		Create a notification for this product.
    nitin247 Place Order Without Payment for WooCommerce Affected: 0 , ≤ 2.6.5 (semver)
    		Create a notification for this product.
    wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages Affected: 0 , ≤ 2.6.7 (semver)
    		Create a notification for this product.
    mihail-barinov Share This Image Affected: 0 , ≤ 2.07 (semver)
    		Create a notification for this product.
    inavii Inavii Social Feed Affected: 0 , ≤ 2.7.0 (semver)
    		Create a notification for this product.
    fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox Affected: 0 , ≤ 2.7.33 (semver)
    		Create a notification for this product.
    xplodedthemes XT Floating Cart for WooCommerce Affected: 0 , ≤ 2.8.4 (semver)
    		Create a notification for this product.
    takanakui WP Mobile Menu – The Mobile-Friendly Responsive Menu Affected: 0 , ≤ 2.8.6 (semver)
    		Create a notification for this product.
    passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization Affected: 0 , ≤ 2.9.2 (semver)
    		Create a notification for this product.
    bensibley Independent Analytics Affected: 0 , ≤ 2.9.7 (semver)
    		Create a notification for this product.
    codesavory Knowledge Base documentation & wiki plugin – BasePress Docs Affected: 0 , ≤ 2.16.3.3 (semver)
    		Create a notification for this product.
    davidanderson Internal Link Juicer: SEO Auto Linker for WordPress Affected: 0 , ≤ 2.24.6 (semver)
    		Create a notification for this product.
    josevega Bulk Edit Posts and Products in Spreadsheet Affected: 0 , ≤ 2.25.16 (semver)
    		Create a notification for this product.
    saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Affected: 0 , ≤ 3.0.0 (semver)
    		Create a notification for this product.
    tobiasbg TablePress – Tables in WordPress made easy Affected: 0 , ≤ 3.0.2 (semver)
    		Create a notification for this product.
    bouncingsprout Ultimeter Affected: 0 , ≤ 3.0.5 (semver)
    		Create a notification for this product.
    blackandwhitedigital TreePress – Easy Family Trees & Ancestor Profiles Affected: 0 , ≤ 3.0.6 (semver)
    		Create a notification for this product.
    mattpramschufer Pay For Post with WooCommerce Affected: 0 , ≤ 3.1.26 (semver)
    		Create a notification for this product.
    koen12344 Post to Google My Business (Google Business Profile) Affected: 0 , ≤ 3.1.28 (semver)
    		Create a notification for this product.
    imtiazrayhan WP Coupons and Deals – Coupon Plugin For Affiliate Marketers Affected: 0 , ≤ 3.2.2 (semver)
    		Create a notification for this product.
    pluginsware Advanced Classifieds & Directory Pro Affected: 0 , ≤ 3.2.4 (semver)
    		Create a notification for this product.
    gallerycreator Mixed Media Gallery Blocks Affected: 0 , ≤ 3.2.4.4 (semver)
    		Create a notification for this product.
    blockspare BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor Affected: 0 , ≤ 3.2.6 (semver)
    		Create a notification for this product.
    mhmrajib AidWP – Donation & Payment Forms (Stripe Powered) Affected: 0 , ≤ 3.2.6 (semver)
    		Create a notification for this product.
    infornweb Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid Affected: 0 , ≤ 3.2.7 (semver)
    		Create a notification for this product.
    pluginandplay Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider Affected: 0 , ≤ 3.2.7 (semver)
    		Create a notification for this product.
    samdani Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews Affected: 0 , ≤ 3.2.8 (semver)
    		Create a notification for this product.
    wpspeedo Team Members Showcase Affected: 0 , ≤ 3.3.0 (semver)
    		Create a notification for this product.
    elespare EleSpare – News, Magazine and Blog Addons for Elementor Affected: 0 , ≤ 3.3.2 (semver)
    		Create a notification for this product.
    infornweb Post List Designer – Category Post, Recent Post, Post List Affected: 0 , ≤ 3.3.7 (semver)
    		Create a notification for this product.
    infornweb Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News Affected: 0 , ≤ 3.4.9 (semver)
    		Create a notification for this product.
    dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress Affected: 0 , ≤ 3.4.12 (semver)
    		Create a notification for this product.
    xplodedthemes WPIDE – File Manager & Code Editor Affected: 0 , ≤ 3.5.1 (semver)
    		Create a notification for this product.
    premmerce Premmerce Product Filter for WooCommerce Affected: 0 , ≤ 3.7.3 (semver)
    		Create a notification for this product.
    afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars Affected: 0 , ≤ 3.8.3 (semver)
    		Create a notification for this product.
    wpmagics Delete Posts automatically Affected: 0 , ≤ 3.9.6 (semver)
    		Create a notification for this product.
    takanakui Menu Image, Icons made easy Affected: 0 , ≤ 3.12 (semver)
    		Create a notification for this product.
    passionatebrains AWCA – The Great Analytics Insights for Your eStore Affected: 0 , ≤ 3.12.0 (semver)
    		Create a notification for this product.
    mikewire_rocksolid Announcement & Notification Banner – Bulletin Affected: 0 , ≤ 3.12.1 (semver)
    		Create a notification for this product.
    nitin247 Thank You Page for WooCommerce Affected: 0 , ≤ 4.2.0 (semver)
    		Create a notification for this product.
    webheadllc Contact Form 7 Multi-Step Forms Affected: 0 , ≤ 4.4.1 (semver)
    		Create a notification for this product.
    speedify Auto-Install Free SSL – Generate & Install Free SSL Certificates Affected: 0 , ≤ 4.5.0 (semver)
    		Create a notification for this product.
    mhmrajib WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes Affected: 0 , ≤ 4.6.8 (semver)
    		Create a notification for this product.
    webba-agency Easy Appointment Booking & Scheduling System – Webba Booking Calendar Affected: 0 , ≤ 5.0.57 (semver)
    		Create a notification for this product.
    invisnet WP fail2ban – Advanced Security Affected: 0 , ≤ 5.3.4 (semver)
    		Create a notification for this product.
    vinod-dalvi Ivory Search – WordPress Search Plugin Affected: 0 , ≤ 5.5.8 (semver)
    		Create a notification for this product.
    peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards Affected: 0 , ≤ 5.5.31 (semver)
    		Create a notification for this product.
    elliotvs Coupon Affiliates – Affiliate Plugin for WooCommerce Affected: 0 , ≤ 5.17.2 (semver)
    		Create a notification for this product.
    cleverplugins Security Ninja – WordPress Security & Firewall Affected: 0 , ≤ 5.222 (semver)
    		Create a notification for this product.
    theafricanboss Checkout with Cash App on WooCommerce Affected: 0 , ≤ 6.0.2 (semver)
    		Create a notification for this product.
    fullworks Display Eventbrite Events Affected: 0 , ≤ 6.1.10 (semver)
    		Create a notification for this product.
    mohsinoffline Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins Affected: 0 , ≤ 6.1.13 (semver)
    		Create a notification for this product.
    sjaved Easy Social Feed – Social Photos Gallery and Post Feed for WordPress Affected: 0 , ≤ 6.6.5 (semver)
    		Create a notification for this product.
    gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Affected: 0 , ≤ 7.3.3 (semver)
    		Create a notification for this product.
    gowebsmarty WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan Affected: 0 , ≤ 7.7.0 (semver)
    		Create a notification for this product.
    tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Affected: 0 , ≤ 8.0.7 (semver)
    		Create a notification for this product.
    Credits
    Asaf Mozes
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-01T13:23:14.835839Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-01T13:23:26.723Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Go Fetch Jobs (for WP Job Manager)",
          "vendor": "sebet",
          "versions": [
            {
              "lessThanOrEqual": "1.8.4.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dynamic Copyright Year",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Code Manager",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "1.0.40",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Scrollbar \u2013 Custom Scrollbar Styling and Behavior",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Goal Tracker \u2013 Custom Event Tracking for GA4",
          "vendor": "yuvalo",
          "versions": [
            {
              "lessThanOrEqual": "1.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent",
          "vendor": "essekia",
          "versions": [
            {
              "lessThanOrEqual": "1.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Page Templates",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "1.1.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Payment Gateway for ACBA BANK",
          "vendor": "hkdigitalagency",
          "versions": [
            {
              "lessThanOrEqual": "1.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Dracula Dark Mode \u2013  Accessibility, Reading Mode \u0026 Dark Mode for WordPress",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "1.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Forumax \u2013 AI Powered Advanced Community Forum Plugin",
          "vendor": "spiderdevs",
          "versions": [
            {
              "lessThanOrEqual": "1.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Five-Star Ratings Shortcode",
          "vendor": "seezee",
          "versions": [
            {
              "lessThanOrEqual": "1.2.56",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Product Layouts for WooCommerce",
          "vendor": "oxilab",
          "versions": [
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Meta Field Block \u2013 Display custom fields in the Block Editor without coding",
          "vendor": "mr2p",
          "versions": [
            {
              "lessThanOrEqual": "1.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Custom WooCommerce Checkout Fields Editor",
          "vendor": "themelocation",
          "versions": [
            {
              "lessThanOrEqual": "1.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Open User Map",
          "vendor": "100plugins",
          "versions": [
            {
              "lessThanOrEqual": "1.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Notification Bell",
          "vendor": "wpdever",
          "versions": [
            {
              "lessThanOrEqual": "1.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Remove Add to Cart WooCommerce",
          "vendor": "themelocation",
          "versions": [
            {
              "lessThanOrEqual": "1.4.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "File Manager for Google Drive \u2013 Integrate Google Drive",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "1.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Marijuana Age Verify",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "RevivePress \u2013 Keep your Old Content Evergreen",
          "vendor": "infosatech",
          "versions": [
            {
              "lessThanOrEqual": "1.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Restaurant \u0026 Cafe Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "1.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Send Users Email \u2013 Email Subscribers, Email Marketing Newsletter",
          "vendor": "paretodigital",
          "versions": [
            {
              "lessThanOrEqual": "1.5.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Unlimited Elements For Elementor",
          "vendor": "unitecms",
          "versions": [
            {
              "lessThanOrEqual": "1.5.140",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Role Based Pricing for Woo by Meow Crew",
          "vendor": "meowcrew",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Primary Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Featured Images in RSS for Mailchimp \u0026 More",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Image Alt Text Manager \u2013 Bulk \u0026 Dynamic Alt Tags For image SEO Optimization + AI",
          "vendor": "wpsaad",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Message Filter for Contact Form 7",
          "vendor": "kofimokome",
          "versions": [
            {
              "lessThanOrEqual": "1.6.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Embedder for Google Reviews",
          "vendor": "paretodigital",
          "versions": [
            {
              "lessThanOrEqual": "1.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MapGeo \u2013 Interactive Geo Maps",
          "vendor": "interactivegeomaps",
          "versions": [
            {
              "lessThanOrEqual": "1.6.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WPBITS Addons For Elementor Page Builder",
          "vendor": "wpbits",
          "versions": [
            {
              "lessThanOrEqual": "1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Widgets on Pages",
          "vendor": "toddhalfpenny",
          "versions": [
            {
              "lessThanOrEqual": "1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spotlight Social Feeds \u2013 Block, Shortcode, and Widget",
          "vendor": "rebelcode",
          "versions": [
            {
              "lessThanOrEqual": "1.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms",
          "vendor": "tobias_conrad",
          "versions": [
            {
              "lessThanOrEqual": "1.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AI Bud \u2013 AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o",
          "vendor": "webfactory",
          "versions": [
            {
              "lessThanOrEqual": "1.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Text To Speech TTS Accessibility",
          "vendor": "hasanazizul",
          "versions": [
            {
              "lessThanOrEqual": "1.7.34",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Age Verify",
          "vendor": "5starplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AI Puffer \u2013 Chat. Create. Automate. (formerly AI Power)",
          "vendor": "senols",
          "versions": [
            {
              "lessThanOrEqual": "1.8.99",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Justified Gallery",
          "vendor": "damian-gora",
          "versions": [
            {
              "lessThanOrEqual": "1.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mapster WP Maps",
          "vendor": "mapster",
          "versions": [
            {
              "lessThanOrEqual": "1.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "StreamWeasels Twitch Integration",
          "vendor": "streamweasels",
          "versions": [
            {
              "lessThanOrEqual": "1.9.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Variation Swatches for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "1.9.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "bBlocks \u2013 Essential Gutenberg Blocks \u0026 Patterns Collection",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "1.9.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "URL Shortify \u2013 Simple and Easy URL Shortener",
          "vendor": "kaizencoders",
          "versions": [
            {
              "lessThanOrEqual": "1.10.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Kikote \u2013 Location Picker at Checkout \u0026 Google Address AutoFill Plugin for WooCommerce",
          "vendor": "uriahs-victor",
          "versions": [
            {
              "lessThanOrEqual": "1.10.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Geo Mashup",
          "vendor": "cyberhobo",
          "versions": [
            {
              "lessThanOrEqual": "1.13.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Disable Payment Methods based on cart conditions for WooCommerce",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "1.16.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Automatic Internal Links for SEO by Pagup",
          "vendor": "pagup",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Full Screen Background",
          "vendor": "enweby",
          "versions": [
            {
              "lessThanOrEqual": "2.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder \u0026 Template Kits",
          "vendor": "litonice13",
          "versions": [
            {
              "lessThanOrEqual": "2.0.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player",
          "vendor": "princeahmed",
          "versions": [
            {
              "lessThanOrEqual": "2.0.82",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Carousel, Recent Post Slider and Banner Slider",
          "vendor": "spicethemes",
          "versions": [
            {
              "lessThanOrEqual": "2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)",
          "vendor": "pagup",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Quick View for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Smart phone field for Gravity Forms",
          "vendor": "pluginscafe",
          "versions": [
            {
              "lessThanOrEqual": "2.1.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Notification Bar, Announcement and Cookie Notice WordPress Plugin \u2013 FooBar",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.1.34",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PDF Poster \u2013 Display PDF Files with Custom Viewer",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Events Addon for Elementor",
          "vendor": "nicheaddons",
          "versions": [
            {
              "lessThanOrEqual": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 \u0026 Audio Player",
          "vendor": "bplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.2.27",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Glossary",
          "vendor": "mte90",
          "versions": [
            {
              "lessThanOrEqual": "2.2.38",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Restrict \u2013 membership, site, content and user access restrictions for WordPress",
          "vendor": "tickera",
          "versions": [
            {
              "lessThanOrEqual": "2.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Custom PHP Settings",
          "vendor": "cyclonecode",
          "versions": [
            {
              "lessThanOrEqual": "2.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Meta and Date Remover",
          "vendor": "prasadkirpekar",
          "versions": [
            {
              "lessThanOrEqual": "2.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Anti-Spam Protection \u2013 No API Key, GDPR Friendly",
          "vendor": "fullworks",
          "versions": [
            {
              "lessThanOrEqual": "2.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Premmerce Permalink Manager for WooCommerce",
          "vendor": "premmerce",
          "versions": [
            {
              "lessThanOrEqual": "2.3.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Music Player for Elementor \u2013 Audio Player \u0026 Podcast Player",
          "vendor": "smartwpress",
          "versions": [
            {
              "lessThanOrEqual": "2.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TopNewsWp \u2013 Display Tikcer News, RSS Feed Widget and Many More",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "2.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ocean Extra",
          "vendor": "oceanwp",
          "versions": [
            {
              "lessThanOrEqual": "2.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Gallery by FooGallery",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.4.27",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Automatic YouTube Gallery",
          "vendor": "plugins360",
          "versions": [
            {
              "lessThanOrEqual": "2.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation \u0026 FAQ Builder",
          "vendor": "spiderdevs",
          "versions": [
            {
              "lessThanOrEqual": "2.5.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Team Members \u2013 A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More",
          "vendor": "samdani",
          "versions": [
            {
              "lessThanOrEqual": "2.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!",
          "vendor": "tonyzeoli",
          "versions": [
            {
              "lessThanOrEqual": "2.5.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "StoreCustomizer \u2013 A plugin to Customize all WooCommerce Pages",
          "vendor": "kaira",
          "versions": [
            {
              "lessThanOrEqual": "2.5.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Joli Table Of Contents",
          "vendor": "wpjoli",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "GA4WP \u2013 Analytics Dashboard for the Website",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Place Order Without Payment for WooCommerce",
          "vendor": "nitin247",
          "versions": [
            {
              "lessThanOrEqual": "2.6.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Better Messages \u2013 Live Chat, Chat Rooms, Real-Time Messaging \u0026 Private Messages",
          "vendor": "wordplus",
          "versions": [
            {
              "lessThanOrEqual": "2.6.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Share This Image",
          "vendor": "mihail-barinov",
          "versions": [
            {
              "lessThanOrEqual": "2.07",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Inavii Social Feed",
          "vendor": "inavii",
          "versions": [
            {
              "lessThanOrEqual": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Lightbox \u0026 Modal Popup WordPress Plugin \u2013 FooBox",
          "vendor": "fooplugins",
          "versions": [
            {
              "lessThanOrEqual": "2.7.33",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XT Floating Cart for WooCommerce",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "2.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu",
          "vendor": "takanakui",
          "versions": [
            {
              "lessThanOrEqual": "2.8.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading \u0026 Image Optimization",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "2.9.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Independent Analytics",
          "vendor": "bensibley",
          "versions": [
            {
              "lessThanOrEqual": "2.9.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Knowledge Base documentation \u0026 wiki plugin \u2013 BasePress Docs",
          "vendor": "codesavory",
          "versions": [
            {
              "lessThanOrEqual": "2.16.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Internal Link Juicer: SEO Auto Linker for WordPress",
          "vendor": "davidanderson",
          "versions": [
            {
              "lessThanOrEqual": "2.24.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Bulk Edit Posts and Products in Spreadsheet",
          "vendor": "josevega",
          "versions": [
            {
              "lessThanOrEqual": "2.25.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TablePress \u2013 Tables in WordPress made easy",
          "vendor": "tobiasbg",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ultimeter",
          "vendor": "bouncingsprout",
          "versions": [
            {
              "lessThanOrEqual": "3.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TreePress \u2013 Easy Family Trees \u0026 Ancestor Profiles",
          "vendor": "blackandwhitedigital",
          "versions": [
            {
              "lessThanOrEqual": "3.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Pay For Post with WooCommerce",
          "vendor": "mattpramschufer",
          "versions": [
            {
              "lessThanOrEqual": "3.1.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post to Google My Business (Google Business Profile)",
          "vendor": "koen12344",
          "versions": [
            {
              "lessThanOrEqual": "3.1.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Coupons and Deals \u2013 Coupon Plugin For Affiliate Marketers",
          "vendor": "imtiazrayhan",
          "versions": [
            {
              "lessThanOrEqual": "3.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Advanced Classifieds \u0026 Directory Pro",
          "vendor": "pluginsware",
          "versions": [
            {
              "lessThanOrEqual": "3.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Mixed Media Gallery Blocks",
          "vendor": "gallerycreator",
          "versions": [
            {
              "lessThanOrEqual": "3.2.4.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "BlockSpare \u2014 News, Magazine and Blog Addons for (Gutenberg) Block Editor",
          "vendor": "blockspare",
          "versions": [
            {
              "lessThanOrEqual": "3.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AidWP \u2013 Donation \u0026 Payment Forms (Stripe Powered)",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "3.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider \u0026 Logo Grid",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post Slider and Post Carousel with Post Vertical Scrolling Widget \u2013 A Responsive Post Slider",
          "vendor": "pluginandplay",
          "versions": [
            {
              "lessThanOrEqual": "3.2.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Solid Testimonials \u2013 Testimonial Slider, Video Testimonials \u0026 Customer Reviews",
          "vendor": "samdani",
          "versions": [
            {
              "lessThanOrEqual": "3.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Team Members Showcase",
          "vendor": "wpspeedo",
          "versions": [
            {
              "lessThanOrEqual": "3.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EleSpare \u2013 News, Magazine and Blog Addons for Elementor",
          "vendor": "elespare",
          "versions": [
            {
              "lessThanOrEqual": "3.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Post List Designer \u2013 Category Post, Recent Post, Post List",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News",
          "vendor": "infornweb",
          "versions": [
            {
              "lessThanOrEqual": "3.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "YASR \u2013 Yet Another Star Rating Plugin for WordPress",
          "vendor": "dashlabsltd",
          "versions": [
            {
              "lessThanOrEqual": "3.4.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WPIDE \u2013 File Manager \u0026 Code Editor",
          "vendor": "xplodedthemes",
          "versions": [
            {
              "lessThanOrEqual": "3.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Premmerce Product Filter for WooCommerce",
          "vendor": "premmerce",
          "versions": [
            {
              "lessThanOrEqual": "3.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors \u0026 Custom Avatars",
          "vendor": "afthemes",
          "versions": [
            {
              "lessThanOrEqual": "3.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Delete Posts automatically",
          "vendor": "wpmagics",
          "versions": [
            {
              "lessThanOrEqual": "3.9.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Menu Image, Icons made easy",
          "vendor": "takanakui",
          "versions": [
            {
              "lessThanOrEqual": "3.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AWCA \u2013 The Great Analytics Insights for Your eStore",
          "vendor": "passionatebrains",
          "versions": [
            {
              "lessThanOrEqual": "3.12.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Announcement \u0026 Notification Banner \u2013 Bulletin",
          "vendor": "mikewire_rocksolid",
          "versions": [
            {
              "lessThanOrEqual": "3.12.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Thank You Page for WooCommerce",
          "vendor": "nitin247",
          "versions": [
            {
              "lessThanOrEqual": "4.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Contact Form 7 Multi-Step Forms",
          "vendor": "webheadllc",
          "versions": [
            {
              "lessThanOrEqual": "4.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Auto-Install Free SSL \u2013 Generate \u0026 Install Free SSL Certificates",
          "vendor": "speedify",
          "versions": [
            {
              "lessThanOrEqual": "4.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Books Gallery \u2013 Build Stunning Book Showcases \u0026 Libraries in Minutes",
          "vendor": "mhmrajib",
          "versions": [
            {
              "lessThanOrEqual": "4.6.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Appointment Booking \u0026 Scheduling System \u2013 Webba Booking Calendar",
          "vendor": "webba-agency",
          "versions": [
            {
              "lessThanOrEqual": "5.0.57",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP fail2ban \u2013 Advanced Security",
          "vendor": "invisnet",
          "versions": [
            {
              "lessThanOrEqual": "5.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Ivory Search \u2013 WordPress Search Plugin",
          "vendor": "vinod-dalvi",
          "versions": [
            {
              "lessThanOrEqual": "5.5.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps \u0026 Dashboards",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.31",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce",
          "vendor": "elliotvs",
          "versions": [
            {
              "lessThanOrEqual": "5.17.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Security Ninja \u2013 WordPress Security \u0026 Firewall",
          "vendor": "cleverplugins",
          "versions": [
            {
              "lessThanOrEqual": "5.222",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Checkout with Cash App on WooCommerce",
          "vendor": "theafricanboss",
          "versions": [
            {
              "lessThanOrEqual": "6.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Display Eventbrite Events",
          "vendor": "fullworks",
          "versions": [
            {
              "lessThanOrEqual": "6.1.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins",
          "vendor": "mohsinoffline",
          "versions": [
            {
              "lessThanOrEqual": "6.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Easy Social Feed \u2013 Social Photos Gallery and Post Feed for WordPress",
          "vendor": "sjaved",
          "versions": [
            {
              "lessThanOrEqual": "6.6.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
          "vendor": "gn_themes",
          "versions": [
            {
              "lessThanOrEqual": "7.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Encryption \u2013 One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan",
          "vendor": "gowebsmarty",
          "versions": [
            {
              "lessThanOrEqual": "7.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto",
          "vendor": "tripetto",
          "versions": [
            {
              "lessThanOrEqual": "8.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Asaf Mozes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-01T05:29:54.148Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3235286/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3249130/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3229060/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-30T17:32:32.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-04-30T17:17:30.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Freemius \u003c= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-13362",
    "datePublished": "2026-05-01T05:29:54.148Z",
    "dateReserved": "2025-01-13T18:08:47.439Z",
    "dateUpdated": "2026-05-01T13:23:26.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-3090 (GCVE-0-2026-3090)

    Vulnerability from cvelistv5 – Published: 2026-03-18 15:28 – Updated: 2026-04-08 16:48
    VLAI
    Title
    Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'
    Summary
    The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_type’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when the Post SMTP Pro plugin is also installed and its Reporting and Tracking extension is enabled.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-03-18 17:01 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Phú
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3090",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-18T17:01:09.399609Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T17:02:50.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ph\u00fa"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018event_type\u2019 parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when the Post SMTP Pro plugin is also installed and its Reporting and Tracking extension is enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:48:13.127Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8cbbbb-2089-4966-8fd3-da4f76fb2517?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/PostmanEmailLogs.php#L459"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3484515/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-24T01:52:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-03-17T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via \u0027event_type\u0027"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-3090",
    "datePublished": "2026-03-18T15:28:29.140Z",
    "dateReserved": "2026-02-24T01:24:00.305Z",
    "dateUpdated": "2026-04-08T16:48:13.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-2559 (GCVE-0-2026-2559)

    Vulnerability from cvelistv5 – Published: 2026-03-18 15:28 – Updated: 2026-04-08 16:45
    VLAI
    Title
    Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite
    Summary
    The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `handle_office365_oauth_redirect()` function in all versions up to, and including, 3.8.0. This is due to the function being hooked to `admin_init` without any `current_user_can()` check or nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the site's Office 365 OAuth mail configuration (access token, refresh token, and user email) via a crafted URL. The configuration option is used during wizard setup of Microsoft365 SMTP, only available in the Pro option of the plugin. This could cause an Administrator to believe an attacker-controlled Azure app is their own, and lead them to connect the plugin to the attacker's account during configuration after upgrading to Pro.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-03-18 17:06 UTC
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Michael Iden
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2559",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-18T17:06:23.958716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T17:06:32.930Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Iden"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `handle_office365_oauth_redirect()` function in all versions up to, and including, 3.8.0. This is due to the function being hooked to `admin_init` without any `current_user_can()` check or nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the site\u0027s Office 365 OAuth mail configuration (access token, refresh token, and user email) via a crafted URL. The configuration option is used during wizard setup of Microsoft365 SMTP, only available in the Pro option of the plugin. This could cause an Administrator to believe an attacker-controlled Azure app is their own, and lead them to connect the plugin to the attacker\u0027s account during configuration after upgrading to Pro."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:45:16.533Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/323436b5-fbfe-4923-8b08-93c1fcabc016?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L2109"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L104"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3484515/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-15T19:21:39.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-03-17T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-2559",
    "datePublished": "2026-03-18T15:28:28.190Z",
    "dateReserved": "2026-02-15T19:05:42.476Z",
    "dateUpdated": "2026-04-08T16:45:16.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-12887 (GCVE-0-2025-12887)

    Vulnerability from cvelistv5 – Published: 2025-12-03 12:29 – Updated: 2026-04-08 16:55
    VLAI
    Title
    Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update
    Summary
    The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the 'handle_gmail_oauth_redirect' function. This makes it possible for authenticated attackers, with subscriber level access and above, to inject invalid or attacker-controlled OAuth credentials. CVE-2025-67563 appears to be a duplicate of this issue.
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-12-03 14:09 UTC
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    M Indra Purnama
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12887",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-03T14:09:06.643764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-03T14:09:43.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "M Indra Purnama"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. This is due to the plugin not properly verifying that a user is authorized to update OAuth tokens on the \u0027handle_gmail_oauth_redirect\u0027 function. This makes it possible for authenticated attackers, with subscriber level access and above, to inject invalid or attacker-controlled OAuth credentials. CVE-2025-67563 appears to be a duplicate of this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:55:27.472Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd9f312-99e1-4dc2-855d-90339c2e24da?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3402203"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-01T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2025-11-07T17:45:14.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-12-03T00:22:23.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP \u0026 Mobile App \u003c= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-12887",
    "datePublished": "2025-12-03T12:29:53.626Z",
    "dateReserved": "2025-11-07T17:28:03.418Z",
    "dateUpdated": "2026-04-08T16:55:27.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-11833 (GCVE-0-2025-11833)

    Vulnerability from cvelistv5 – Published: 2025-11-01 03:34 – Updated: 2026-04-08 16:50
    VLAI
    Title
    Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure
    Summary
    The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-11-03 15:47 UTC
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Carl Pearson
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11833",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-03T15:47:14.968225Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-03T15:47:23.380Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Carl Pearson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP \u0026 Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:50:24.214Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/491f44fc-712c-4f67-b5c2-a7396941afc1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/tags/3.5.0/Postman/PostmanEmailLogs.php#L51"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3386160/post-smtp"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-15T19:30:48.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-10-31T14:46:56.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP \u0026 Mobile App \u003c= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-11833",
    "datePublished": "2025-11-01T03:34:35.794Z",
    "dateReserved": "2025-10-15T19:10:23.277Z",
    "dateUpdated": "2026-04-08T16:50:24.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-9219 (GCVE-0-2025-9219)

    Vulnerability from cvelistv5 – Published: 2025-09-03 08:27 – Updated: 2026-04-08 16:57
    VLAI
    Title
    Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update
    Summary
    The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback' function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-09-03 13:27 UTC
    CWE
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Matteo Leonelli David Dewes
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-03T13:27:13.724015Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-03T13:27:25.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Leonelli"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "David Dewes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP \u2013 WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications \u2013 Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027update_post_smtp_pro_option_callback\u0027 function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:57:49.947Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/65914bbf-6563-4bf2-a358-885e182a1365?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L1858"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3353624/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-20T17:23:11.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-09-02T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-9219",
    "datePublished": "2025-09-03T08:27:23.212Z",
    "dateReserved": "2025-08-19T23:24:12.546Z",
    "dateUpdated": "2026-04-08T16:57:49.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-13844 (GCVE-0-2024-13844)

    Vulnerability from cvelistv5 – Published: 2025-03-08 05:30 – Updated: 2026-04-08 16:33
    VLAI
    Title
    Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter
    Summary
    The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
    Severity
    4.9 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-03-10 14:49 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Nhien Pham
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13844",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T14:49:49.092247Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-12T15:32:37.834Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nhien Pham"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the \u2018columns\u2019 parameter in all versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:33:21.343Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0540f70d-009a-4776-8717-f096e30a11d3?source=cve"
        },
        {
          "url": "https://gist.github.com/nhienit2010/d4692062f54b89e16aa068a0ef142cf6#file-postmanemailquerylog-php-L314"
        },
        {
          "url": "https://wordpress.org/plugins/post-smtp/#developers"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3249371/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-07T16:21:23.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-13844",
    "datePublished": "2025-03-08T05:30:08.283Z",
    "dateReserved": "2025-02-06T20:11:02.474Z",
    "dateUpdated": "2026-04-08T16:33:21.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-0521 (GCVE-0-2025-0521)

    Vulnerability from cvelistv5 – Published: 2025-02-18 11:10 – Updated: 2026-04-08 16:46
    VLAI
    Title
    Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting
    Summary
    The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-02-18 14:26 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    D.Sim
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0521",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T14:26:02.492087Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T14:26:27.507Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "D.Sim"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:46:08.793Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/366dfbf1-870c-4ce3-abc4-a2b2f4e72175?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3237626%40post-smtp%2Ftrunk\u0026old=3229076%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-02-17T22:24:21.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 3.0.2 - Unauthenticated Stored Cross-Site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-0521",
    "datePublished": "2025-02-18T11:10:18.504Z",
    "dateReserved": "2025-01-16T17:53:46.524Z",
    "dateUpdated": "2026-04-08T16:46:08.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-5207 (GCVE-0-2024-5207)

    Vulnerability from cvelistv5 – Published: 2024-05-30 05:33 – Updated: 2026-04-08 16:35
    VLAI
    Title
    POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection
    Summary
    The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the selected parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator access or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-05-30 14:22 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    ngocanh le
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5207",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-30T14:22:11.126597Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:02:40.236Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:03:11.068Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/103db583-9399-4a45-a316-808b55fc6a6c?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Postman-Email-Log/PostmanEmailQueryLog.php?rev=2974258#L262"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3094453%40post-smtp%2Ftrunk\u0026old=3090744%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ngocanh le"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The POST SMTP \u2013 The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the selected parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers with administrator access or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:35:56.097Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/103db583-9399-4a45-a316-808b55fc6a6c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Postman-Email-Log/PostmanEmailQueryLog.php?rev=2974258#L262"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3094453%40post-smtp%2Ftrunk\u0026old=3090744%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-05-22T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \u003c= 2.9.3 - Authenticated (Administrator+) SQL Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-5207",
    "datePublished": "2024-05-30T05:33:15.366Z",
    "dateReserved": "2024-05-22T16:28:30.293Z",
    "dateUpdated": "2026-04-08T16:35:56.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-6875 (GCVE-0-2023-6875)

    Vulnerability from cvelistv5 – Published: 2024-01-11 08:33 – Updated: 2026-04-08 17:30
    VLAI Shadowserver Previdian
    Title
    POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
    Summary
    The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-05-08 15:41 UTC
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    • CWE-862 - Missing Authorization
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Ulyses Saicha
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:42:08.006Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L60"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk?contextall=1\u0026old=3012318\u0026old_path=%2Fpost-smtp%2Ftrunk"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/176525/WordPress-POST-SMTP-Mailer-2.8.7-Authorization-Bypass-Cross-Site-Scripting.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:41:09.652845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:08:33.781Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.8.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ulyses Saicha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:30:11.388Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L60"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk?contextall=1\u0026old=3012318\u0026old_path=%2Fpost-smtp%2Ftrunk"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-01-10T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \u003c= 2.8.7 - Authorization Bypass via type connect-app API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-6875",
    "datePublished": "2024-01-11T08:33:06.214Z",
    "dateReserved": "2023-12-15T18:36:38.930Z",
    "dateUpdated": "2026-04-08T17:30:11.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-7027 (GCVE-0-2023-7027)

    Vulnerability from cvelistv5 – Published: 2024-01-03 04:29 – Updated: 2026-04-08 17:03
    VLAI
    Title
    POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device
    Summary
    The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ header in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-11-14 18:41 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Sean Murphy
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:50:08.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8911a3-ce0f-420c-bf2a-1c2929d01cef?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L79"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/mobile.php#L219"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3016126%40post-smtp%2Ftrunk\u0026old=3012318%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/176525/WordPress-POST-SMTP-Mailer-2.8.7-Authorization-Bypass-Cross-Site-Scripting.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-7027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-14T18:41:09.897882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-14T18:41:25.143Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.8.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sean Murphy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018device\u2019 header in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:03:10.198Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8911a3-ce0f-420c-bf2a-1c2929d01cef?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L79"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/mobile.php#L219"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3016126%40post-smtp%2Ftrunk\u0026old=3012318%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-01-02T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \u003c= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-7027",
    "datePublished": "2024-01-03T04:29:34.469Z",
    "dateReserved": "2023-12-20T18:53:20.908Z",
    "dateUpdated": "2026-04-08T17:03:10.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-6629 (GCVE-0-2023-6629)

    Vulnerability from cvelistv5 – Published: 2024-01-03 04:29 – Updated: 2026-04-08 17:01
    VLAI
    Title
    POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg
    Summary
    The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-6621 appears to be a duplicate of this issue. CVE-2024-29128 appears to be a duplicate of this issue.
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-01-08 20:37 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Matan Berson
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:35:14.828Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7681f984-d488-4da7-afe1-988e5ad012f2?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L396"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3012318%40post-smtp%2Ftrunk\u0026old=3006604%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail=#file4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6629",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-08T20:37:11.497261Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T20:29:08.485Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.8.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matan Berson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018msg\u2019 parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-6621 appears to be a duplicate of this issue. CVE-2024-29128 appears to be a duplicate of this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:01:31.782Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7681f984-d488-4da7-afe1-988e5ad012f2?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L396"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3012318%40post-smtp%2Ftrunk\u0026old=3006604%40post-smtp%2Ftrunk\u0026sfp_email=\u0026sfph_mail=#file4"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-01-02T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "POST SMTP Mailer \u003c= 2.8.6 - Reflected Cross-Site Scripting via msg"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-6629",
    "datePublished": "2024-01-03T04:29:33.793Z",
    "dateReserved": "2023-12-08T16:05:50.184Z",
    "dateUpdated": "2026-04-08T17:01:31.782Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2021-4422 (GCVE-0-2021-4422)

    Vulnerability from cvelistv5 – Published: 2023-07-12 06:52 – Updated: 2026-04-08 17:28
    VLAI
    Title
    POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass
    Summary
    The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-10-21 18:10 UTC
    CWE
    • CWE-352 - Cross-Site Request Forgery (CSRF)
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Jerome Bruandet
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:23:10.780Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e018ca7c-06dd-4d40-91d4-4ed188b8aaf2?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2473579%40post-smtp\u0026new=2473579%40post-smtp\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-4422",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T18:10:26.067174Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T18:10:38.184Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.0.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jerome Bruandet"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:28:38.403Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e018ca7c-06dd-4d40-91d4-4ed188b8aaf2?source=cve"
        },
        {
          "url": "https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/"
        },
        {
          "url": "https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/"
        },
        {
          "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/"
        },
        {
          "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/"
        },
        {
          "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/"
        },
        {
          "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/"
        },
        {
          "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2473579%40post-smtp\u0026new=2473579%40post-smtp\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2021-03-01T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "POST SMTP Mailer \u003c= 2.0.20 - Cross-Site Request Forgery Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2021-4422",
    "datePublished": "2023-07-12T06:52:35.453Z",
    "dateReserved": "2023-07-11T18:37:13.653Z",
    "dateUpdated": "2026-04-08T17:28:38.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-3082 (GCVE-0-2023-3082)

    Vulnerability from cvelistv5 – Published: 2023-07-12 04:38 – Updated: 2026-04-08 16:59
    VLAI
    Title
    Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email
    Summary
    The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-02-05 18:38 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA under the mitre root
    CNA scorecard C 65/100 over 2175 records in the last 180 days details
    References
    Impacted products
    Credits
    Alex Thomas
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:41:04.212Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ecd0fa6-4fdb-4780-9560-0bb126800685?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/2935537/post-smtp"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3082",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-05T18:38:23.734298Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T19:40:54.881Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
          "vendor": "saadiqbal",
          "versions": [
            {
              "lessThanOrEqual": "2.5.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alex Thomas"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:59:46.955Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ecd0fa6-4fdb-4780-9560-0bb126800685?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/2935537/post-smtp"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-02T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2023-06-05T00:00:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2023-07-11T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Post SMTP \u003c= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-3082",
    "datePublished": "2023-07-12T04:38:45.662Z",
    "dateReserved": "2023-06-03T03:15:56.101Z",
    "dateUpdated": "2026-04-08T16:59:46.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}