saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App vulnerabilities

29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App version is affected

Latest saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App vulnerabilities

CVE-2026-81278 — WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability (CVSS 5.4)
CVE-2026-48838 — WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2024-13362 — Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
CVE-2026-3090 — Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type' (CVSS 7.2)
CVE-2026-2559 — Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite (CVSS 5.3)
CVE-2025-67563 — WordPress Post SMTP plugin <= 3.6.1 - Broken Access Control vulnerability (CVSS 5.3)
CVE-2025-12887 — Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update (CVSS 5.4)
CVE-2025-11833 — Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure (CVSS 9.8)
CVE-2025-9219 — Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update (CVSS 4.3)
CVE-2025-24000 — WordPress Post SMTP plugin <= 3.2.0 - Account Takeover Vulnerability (CVSS 8.8)
CVE-2024-13844 — Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter (CVSS 4.9)
CVE-2025-0521 — Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
CVE-2025-22800 — WordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerability (CVSS 8.8)
CVE-2024-52436 — WordPress Post SMTP plugin <= 2.9.9 - SQL Injection vulnerability (CVSS 7.2)
CVE-2023-52233 — WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerability (CVSS 9.8)
CVE-2024-5207 — POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection (CVSS 7.2)
CVE-2024-29128 — WordPress POST SMTP Mailer plugin <= 2.8.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
CVE-2023-3178 — POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF (CVSS 4.3)
CVE-2023-6620 — Post SMTP < 2.8.7 - Admin+ SQL Injection (CVSS 7.2)
CVE-2023-6875 — POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API (CVSS 9.8)
CVE-2023-6621 — Post SMTP < 2.8.7 - Reflected Cross-Site Scripting (CVSS 6.1)
CVE-2023-7027 — POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device (CVSS 5.4)
CVE-2023-6629 — POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg (CVSS 6.1)
CVE-2023-5958 — POST SMTP Mailer < 2.7.1 - Unauthenticated Cross-site Scripting (CVSS 6.1)
CVE-2023-3179 — POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF (CVSS 8.8)