WordPress post-smtp has 15 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-6875 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unau | critical | 9.8 | <=2.8.7 | – |
| CVE-2023-6620 | The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL stateme | high | 7.2 | <2.8.7 | 2.8.7 |
| CVE-2022-2352 | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high | high | 7.2 | <2.1.7 | 2.1.7 |
| CVE-2023-7027 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stor | high | 7.2 | <2.8.8 | 2.8.8 |
| CVE-2022-2351 | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashb | medium | 4.8 | <2.1.4 | 2.1.4 |
| CVE-2021-4422 | The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due | medium | 4.3 | <=2.0.20 | – |
| CVE-2023-5958 | The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an un | medium | 6.1 | <2.7.1 | 2.7.1 |
| CVE-2023-3082 | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 d | high | 7.2 | <2.5.8 | 2.5.8 |
| CVE-2024-5207 | The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerab | high | 7.2 | <2.9.4 | 2.9.4 |
| CVE-2023-6629 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Refl | medium | 6.1 | <2.8.7 | 2.8.7 |
| CVE-2023-6621 | The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to | medium | 6.1 | <2.8.7 | 2.8.7 |
| CVE-2024-13844 | The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, | medium | 4.9 | <3.1.3 | 3.1.3 |
| CVE-2023-3179 | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to mak | high | 8.8 | <2.5.7 | 2.5.7 |
| CVE-2025-0521 | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, an | high | 7.2 | <3.1.0 | 3.1.0 |
| CVE-2023-3178 | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to mak | medium | 4.3 | <2.5.7 | 2.5.7 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked