FluentSMTP CVE-2026-16636

Three conditions must all be true for exploitation to succeed. First, FluentSMTP's Email Log feature must be enabled and actively storing outbound email records - sites with logging disabled are not affected. Second, the attacker must be able to influence the to.name (recipient display name) parameter of a wp_mail() call on the target site; this is commonly achievable by submitting a contact form, registration, or any plugin that accepts user-controlled email recipient names, requiring no authentication on the WordPress site itself. Third, an authenticated WordPress administrator must open the Email Log detail view for the poisoned log entry using the Prev/Next navigation controls - simply viewing the list view does not trigger the payload because that path uses escapeHtml. The CVSS PR:N metric correctly reflects no attacker privileges, but the UI:N designation overstates risk; real exploitation is gated on privileged administrator action in a specific UI flow.

The NVD-assigned CVSS score of 7.2 relies on a UI:N metric, which is inconsistent with the described exploitation path - payload execution requires an administrator to open a specific email log detail view and use Prev/Next navigation controls. A more accurate vector (UI:R) would yield approximately 6.1 (Medium). Scope is marked Changed (S:C) because the XSS crosses from the plugin log data into the administrator's browser context, enabling session hijacking or admin-level WordPress actions. Attack Complexity is genuinely Low because no race condition or special setup is needed beyond triggering a wp_mail() call with an attacker-controlled to.name value, which many WordPress plugins and contact forms do on behalf of site visitors. No EPSS score was provided; no KEV listing or POC code was identified, suggesting exploitation has not been observed at scale. The practical risk is elevated where email logging is actively reviewed by administrators and where the site receives untrusted mail-triggering input (contact forms, registration flows).

An attacker submits a contact form or triggers any WordPress action that calls wp_mail() with an attacker-controlled display name set to a JavaScript payload (e.g., a name field containing a script tag). FluentSMTP logs the outbound email including the unsanitized to.name value. When an administrator later browses the Email Log and uses the Prev/Next navigation arrows to open the detail view for that log entry, the stored script executes in the admin's browser context, potentially exfiltrating session cookies or performing privileged WordPress actions on the attacker's behalf.