Post SMTP EUVD-2026-92961

Requires a WordPress Multisite installation with public user registration enabled - on such sites an unauthenticated attacker can self-register with a crafted email address. The specific mechanism is that WordPress accepts email addresses containing numeric HTML character references while Post SMTP's stricter validator rejects them, so the send fails and the raw attacker-supplied address is persisted verbatim into the email log via the failed-send exception message. Execution additionally requires that an administrator (or other user) subsequently views the affected email-log page in wp-admin, where the payload is rendered without sufficient output escaping. Limiting factors: Multisite plus open registration is non-default and uncommon; on standard single-site installs the unauthenticated path described does not apply; and the payload is inert until the log page is viewed. Affected versions are all releases up to and including 4.0.1; upgrading to 4.0.2 remediates.

Signals are mixed and point to a conditional, not broadly urgent, risk. The vendor CVSS of 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) treats this as a network-reachable, unauthenticated, no-interaction stored XSS with scope change - which on its face reads as high priority. However, the description materially qualifies the PR:N: truly unauthenticated exploitation is only possible on WordPress Multisite installations with public user registration enabled, which is a non-default and relatively uncommon deployment, so the effective attack surface is far narrower than the vector alone suggests. No KEV listing and no public POC were provided, and no EPSS score is present in the input, so there is no evidence of active or probable near-term exploitation - status is 'no public exploit identified at time of analysis.' Note also a tension with the UI:N metric: while injection is unauthenticated, the stored payload only executes when an administrator later opens the Post SMTP email log in wp-admin, which is arguably a form of victim interaction even though Wordfence scored it UI:N. Net: a legitimately high-CVSS flaw that is a moderate real-world priority - meaningful on open Multisite portals, low exposure on the typical single-site default install. Patch (4.0.2) availability is the decisive mitigating factor.

On a WordPress Multisite with open public registration, an attacker registers using an email address containing numeric HTML character references that WordPress accepts but Post SMTP's stricter validator rejects, triggering a failed-send exception that writes the raw, attacker-controlled address into the plugin's email log. When a site administrator later opens the email log in wp-admin, the unescaped script executes in their authenticated browser session. No public proof-of-concept exploit was identified in the provided data.