VendorsWPExpertspost_smtpany version
Vulnerabilities

WPExperts Post SMTP any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

19CVEs
CVE-2023-6875
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
Published 2024-01-11 · Modified
9.8EPSS 0.903
CVE-2023-52233
WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerability
Published 2024-06-11 · Modified
9.8EPSS 0.004
CVE-2023-3179
POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF
Published 2023-07-17 · Modified
8.8EPSS 0.004
CVE-2025-22800
WordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerability
Published 2025-01-13 · Modified
8.8EPSS 0.004
CVE-2024-52436
WordPress Post SMTP plugin <= 2.9.9 - SQL Injection vulnerability
Published 2024-11-18 · Modified
7.6EPSS 0.005
CVE-2023-6620
Post SMTP < 2.8.7 - Admin+ SQL Injection
Published 2024-01-15 · Modified
7.2EPSS 0.141
CVE-2022-2352
Post SMTP < 2.1.7 - Admin+ Blind SSRF
Published 2022-09-26 · Modified
7.2EPSS 0.013
CVE-2023-7027
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device
Published 2024-01-03 · Modified
7.2EPSS 0.009
CVE-2023-3082
Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email
Published 2023-07-12 · Modified
7.2EPSS 0.005
CVE-2024-5207
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection
Published 2024-05-30 · Modified
7.2EPSS 0.005
CVE-2025-0521
Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting
Published 2025-02-18 · Analyzed
7.2EPSS 0.003
CVE-2024-29128
WordPress POST SMTP Mailer plugin <= 2.8.6 - Reflected Cross Site Scripting (XSS) vulnerability
Published 2024-03-19 · Modified
7.1EPSS 0.004
CVE-2023-5958
POST SMTP Mailer < 2.7.1 - Unauthenticated Cross-site Scripting
Published 2023-11-27 · Modified
6.1EPSS 0.005
CVE-2023-6629
POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg
Published 2024-01-03 · Modified
6.1EPSS 0.004
CVE-2023-6621
Post SMTP < 2.8.7 - Reflected Cross-Site Scripting
Published 2024-01-03 · Modified
6.1EPSS 0.004
CVE-2024-13844
Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter
Published 2025-03-08 · Analyzed
4.9EPSS 0.004
CVE-2022-2351
Post SMTP < 2.1.4 - Admin+ Stored Cross-Site Scripting
Published 2022-09-16 · Modified
4.8EPSS 0.007
CVE-2021-4422
POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass
Published 2023-07-12 · Modified
4.3EPSS 0.005
CVE-2023-3178
POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF
Published 2024-01-16 · Modified
4.3EPSS 0.003