7.2 High

CVE-2025-0521 The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in…

Description

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product	Affected versions	Fixed in
Post SMTP – WordPress SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more 3.0	earliest → 3.0.2	No fix stated
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 3.0	earliest → 3.0.2	No fix stated

Do you use Post SMTP – WordPress SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more?

Track this CVE Watch Post SMTP – WordPress SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more Check my SBOMs

www.cveye.io/en/cve/CVE-2025-0521

Timeline

Published February 18, 2025
Last modified April 8, 2026

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE