What is the CVSS score of CVE-2026-48838?

CVE-2026-48838 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Post SMTP are affected by CVE-2026-48838?

WordPress administrators running Post SMTP versions 3.6.2 or earlier face immediate risk of account compromise through browser-based script injection attacks that can bypass authentication controls.

How to fix or mitigate CVE-2026-48838?

Within 24 hours: Audit all WordPress installations to identify Post SMTP plugin versions 3.6.2 or earlier. Within 7 days: Disable the plugin where operationally feasible, or implement WAF rules to block XSS attack patterns in plugin parameters. Within 30 days: Monitor vendor advisory channels for security updates; evaluate alternative SMTP solutions with hardened security posture.

Post SMTP CVE-2026-48838

EUVD-2026-36845 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-h4p6-m7g5-cfp4

XSS Post Smtp

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated reflected/stored XSS reachable over the network with low complexity; victim interaction required, scope change into authenticated WP admin context yields low C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:50 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.

AnalysisAI

Reflected or stored cross-site scripting in the Post SMTP WordPress plugin (versions 3.6.2 and earlier) allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser after user interaction. The CVSS 7.1 score with scope change reflects potential session theft or administrative action hijacking against WordPress sites running the plugin. No public exploit identified at time of analysis, and the issue is tracked by Patchstack but not listed in CISA KEV.

Technical ContextAI

Post SMTP (CPE cpe:2.3:a:wpexperts:post_smtp) is a widely deployed WordPress plugin from WPExperts that replaces the default wp_mail() function to route outbound mail through SMTP, Mailgun, SendGrid, and similar providers, and includes a dashboard for logs, diagnostics, and test-email tooling. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-supplied input is rendered in a page context without adequate output encoding or sanitization, allowing browser execution of attacker-controlled JavaScript. Because the issue is reachable without authentication, the injection sink is exposed on a public endpoint of the plugin rather than gated behind wp-admin capability checks.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should update Post SMTP to the latest available release from the WordPress plugin repository above 3.6.2 and verify the changelog references the XSS fix referenced at https://patchstack.com/database/wordpress/plugin/post-smtp/vulnerability/wordpress-post-smtp-plugin-3-6-2-cross-site-scripting-xss-vulnerability. As compensating controls while patching, deploy a WordPress-aware WAF rule (Patchstack, Wordfence, or equivalent) to filter script payloads against the plugin's public endpoints, restrict access to Post SMTP's logging, diagnostic, and test-email pages via web-server ACLs or an auth gate (trade-off: blocks legitimate anonymous bounce/tracking callbacks if any are exposed), and tighten the site's Content-Security-Policy to disallow inline script execution (trade-off: may break other plugins or themes that rely on inline JS). If the plugin's mail-tracking or bounce-handling features are unused, disable them in plugin settings to reduce the unauthenticated attack surface.