What is the CVSS score of EUVD-2026-12841?

EUVD-2026-12841 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by EUVD-2026-12841?

A stored cross-site scripting vulnerability in the Post SMTP WordPress plugin allows unauthenticated attackers to inject malicious scripts into affected websites.

How to fix or mitigate EUVD-2026-12841?

Within 24 hours: audit all WordPress installations for Post SMTP plugin presence and Pro version status; document affected sites and take inventory of exposed data. Within 7 days: implement WAF rules blocking malicious payloads to the 'event_type' parameter; disable Post SMTP Reporting and Tracking extension on all affected sites if operationally feasible. Within 30 days: identify alternative SMTP solutions, develop migration plan, and transition away from Post SMTP or await vendor patch; conduct security assessment of compromised sites for evidence of exploitation.

WordPress EUVD-2026-12841

| CVE-2026-3090 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-18 Wordfence

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 18, 2026 - 15:45 euvd

EUVD-2026-12841

Analysis Generated

Mar 18, 2026 - 15:45 vuln.today

CVE Published

Mar 18, 2026 - 15:28 nvd

HIGH 7.2

DescriptionCVE.org

The Post SMTP - Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_type’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when the Post SMTP Pro plugin is also installed and its Reporting and Tracking extension is enabled.

AnalysisAI

A stored cross-site scripting (XSS) vulnerability exists in the Post SMTP WordPress plugin through version 3.8.0, allowing unauthenticated attackers to inject malicious scripts via the 'event_type' parameter. The vulnerability requires the Post SMTP Pro plugin with its Reporting and Tracking extension to be enabled for exploitation. With a CVSS score of 7.2 and unauthenticated network-based exploitation possible, this represents a moderate-to-high severity risk for WordPress sites using both the free and Pro versions of Post SMTP together.

Technical ContextAI

The vulnerability affects Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App (CPE: cpe:2.3:a:saadiqbal:post_smtp_–_complete_email_deliverability_and_smtp_solution_with_email_logs,_alerts,_backup_smtp_&_mobile_app:*:*:*:*:*:*:*:*), a WordPress plugin that handles email delivery via SMTP. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the PostmanEmailLogs.php file at line 459 where the 'event_type' parameter is processed without adequate sanitization before being output to the page. This allows untrusted user input to be stored in the database and later rendered as executable JavaScript when administrators or users view the affected pages, creating a persistent XSS condition. The vulnerability is conditional on the Post SMTP Pro plugin being installed with its Reporting and Tracking extension enabled, limiting the attack surface to sites using both the free and premium versions simultaneously.

RemediationAI

Upgrade the Post SMTP plugin to version 3.8.1 or later, which addresses the input sanitization issue in the 'event_type' parameter as documented in changeset 3484515 available at https://plugins.trac.wordpress.org/changeset/3484515/. Site administrators should update through the WordPress plugin management interface or manually download the patched version from the official WordPress plugin repository. Until patching is completed, temporary mitigation can be achieved by disabling the Reporting and Tracking extension in the Post SMTP Pro plugin settings, which removes the exploitable attack surface, or by implementing Web Application Firewall rules to filter malicious input to the 'event_type' parameter. Review existing email logs and tracking data for suspicious script content that may have been injected prior to patching, and consider implementing Content Security Policy headers to limit the impact of any residual XSS payloads.