CVE-2026-48838 Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions

Description

Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.

Affected products and versions

Product	Affected versions	Fixed in
Post SMTP 3.6	earliest → 3.6.2	No fix stated

Other CVEs of Post SMTP

The 3 CVEs of Post SMTP →

CVE-2026-81278 Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control… 5.4 Medium CVE-2025-24000 Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows… 8.8 High