What is the CVSS score of CVE-2026-16636?

CVE-2026-16636 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of FluentSMTP are affected by CVE-2026-16636?

FluentSMTP WordPress plugin (versions ≤ 2.2.95) contains a stored injection vulnerability in its email logging interface that could allow unauthorized exploitation of administrator accounts; no…

How to fix or mitigate CVE-2026-16636?

Conduct an immediate audit of all WordPress installations to identify those running FluentSMTP versions 2.2.95 or earlier, targeting completion within 24 hours. Within 7 days, upgrade all affected installations to FluentSMTP 2.3.0 or later via the WordPress plugin repository. Within 30 days, review email logs for indicators of exploitation attempts, implement additional access logging for administrator interactions with the email log feature, and configure Web Application Firewall rules to detect malicious injection patterns in email fields.

FluentSMTP CVE-2026-16636

EUVD-2026-53702 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Wordfence

GHSA-v4r4-2fwc-5qq5

WordPress XSS Google Wordpress Plugin Fluentsmtp Wp Smtp Plugin With Amazon Ses Sendgrid Mailgun Postmark Cloudflare Tosend Gmail And Any Smtp Wpmanageninja

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Payload execution requires active admin navigation in detail view (UI:R); all other metrics match provided vector; no availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 04:46 vuln.today

CVE Published

Aug 06, 2026 - 03:26 cve.org

HIGH 7.2

DescriptionCVE.org

The FluentSMTP - WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via an attacker-controlled recipient display name (to.name) in a wp_mail() call and does not fire in the log list view - only in the detail view when an administrator uses the Prev/Next navigation controls, as that path bypasses the escapeHtml pipeline used by the list view.

AnalysisAI

Stored XSS in FluentSMTP (WordPress plugin) versions up to and including 2.2.95 allows unauthenticated attackers to persist malicious scripts inside the plugin's Email Log detail view by controlling the recipient display name (to.name) field in any wp_mail() invocation. The payload bypasses the escapeHtml sanitization applied by the log list view and fires exclusively in the detail view when an administrator uses the Prev/Next navigation controls, meaning the attack surface is narrower than the CVSS UI:N vector implies. No public exploit code or CISA KEV listing has been identified; a patched version (2.3.0) is confirmed available via the WordPress plugin repository.

Technical ContextAI

FluentSMTP is a WordPress SMTP abstraction plugin (CPE: cpe:2.3:a:wpmanageninja:fluentsmtp) that routes outgoing mail through providers including Amazon SES, SendGrid, Mailgun, Postmark, and Gmail. The vulnerability (CWE-79 - Improper Neutralization of Input During Web Page Generation) originates in the handling of the to.name parameter inside BaseHandler.php (L290, L357) and Logger.php (L165, L310), where the recipient display name from wp_mail() arguments is persisted to the email log without adequate sanitization. The list view correctly runs output through an escapeHtml pipeline in fluent-mail-admin-app.js; however, the Prev/Next detail navigation code path skips this pipeline, rendering the raw stored value directly into the DOM and enabling script execution in the administrator's browser context.

RemediationAI

Vendor-released patch: 2.3.0. Upgrade FluentSMTP to version 2.3.0 or later immediately; the fix is confirmed in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&new=3635135%40fluent-smtp%2Ftags%2F2.3.0&old=3428610%40fluent-smtp%2Ftags%2F2.2.95 and in the updated fluent-mail-admin-app.js at https://plugins.trac.wordpress.org/changeset/3635135/fluent-smtp/trunk/assets/admin/js/fluent-mail-admin-app.js. If immediate upgrade is not possible, the primary compensating control is to disable or restrict access to the FluentSMTP Email Log detail view - this eliminates the only code path where the payload executes, as the list view is not affected. Additionally, restricting which WordPress roles can access the SMTP log screen limits the attack surface. Note that disabling email logging entirely would prevent payload storage but may impair deliverability troubleshooting. Do not rely on input filtering at the wp_mail() call layer alone, as the root cause is output encoding in the detail view renderer.