Post Smtp Complete Email Delivery And Smtp Solution With Email Logs Alerts Backup Smtp Mobile App
Monthly
Stored cross-site scripting in the WordPress plugin Post SMTP (Complete Email Deliverability and SMTP Solution) affects all versions up to and including 4.0.1, allowing an unauthenticated attacker to persist arbitrary script content through the 'user_email' parameter. Exploitation is conditional: it requires a WordPress Multisite installation with public user registration enabled, where WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, causing the send to fail and the raw attacker-controlled address to be written verbatim into the email log via the failed-send exception message; the payload then executes when an administrator views the affected email-log page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterized as conditional rather than broadly urgent because the prerequisite Multisite-plus-open-registration configuration is non-default and the payload is inert until an admin opens the log view. Upgrading to 4.0.2 remediates the issue.
Stored cross-site scripting in the WordPress plugin Post SMTP (Complete Email Deliverability and SMTP Solution) affects all versions up to and including 4.0.1, allowing an unauthenticated attacker to persist arbitrary script content through the 'user_email' parameter. Exploitation is conditional: it requires a WordPress Multisite installation with public user registration enabled, where WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, causing the send to fail and the raw attacker-controlled address to be written verbatim into the email log via the failed-send exception message; the payload then executes when an administrator views the affected email-log page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterized as conditional rather than broadly urgent because the prerequisite Multisite-plus-open-registration configuration is non-default and the payload is inert until an admin opens the log view. Upgrading to 4.0.2 remediates the issue.