Plugin security history

Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 26 vulnerability records associated with Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

26Total records

2Critical

10High

14Medium

0Low

0Informational

26Patched records

0Currently marked unpatched

2021-03-01First disclosure

2026-05-28Latest disclosure

25 of 26CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	1	1 records
2022	2	2 records
2023	7	7 records
2024	5	5 records
2025	7	7 records
2026	4	4 records

Severity Breakdown

Severity	Records	Share
Critical	2	7.7%
High	10	38.5%
Medium	14	53.8%

Vulnerability-Type Breakdown

Cross-Site Scripting

10 records38.5%

First: 2022. Latest: 2026.

Missing Authorization

7 records26.9%

First: 2024. Latest: 2026.

SQL Injection

5 records19.2%

First: 2023. Latest: 2025.

CSRF

3 records11.5%

First: 2021. Latest: 2023.

Other

1 record3.8%

First: 2022. Latest: 2022.

Patch Status

Patched: 26
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.6.3
3.9.0
3.6.2
3.6.1
3.4.2
3.3.0
3.1.3
3.1.0
2.9.12
2.9.10
2.9.4
2.8.8
2.8.7
2.7.1
2.6.1
2.5.9-beta.1
2.5.8
2.5.7
2.1.7
2.1.4
2.0.21

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.6.2`	Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting	May 28, 2026	3.6.3	High
`*-3.0.0`	Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter	April 30, 2026	3.1.0	Medium
`*-3.8.0`	Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'	March 17, 2026	3.9.0	High
`*-3.8.0`	Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite	March 17, 2026	3.9.0	Medium
`*-3.6.1`	Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update	December 3, 2025	3.6.2	Medium
`*-3.6.0`	Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure	October 31, 2025	3.6.1	Critical
`*-3.4.1`	Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update	September 2, 2025	3.4.2	Medium
`*-3.2.0`	Post SMTP <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via Email Log Exposure	July 21, 2025	3.3.0	High
`*-3.1.2`	Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter	March 7, 2025	3.1.3	Medium
`*-3.0.2`	Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting	February 17, 2025	3.1.0	High
`*-2.9.11`	Post SMTP <= 2.9.11 - Missing Authorization via regenerate_qrcode()	January 7, 2025	2.9.12	Medium
`*-2.9.9`	Post SMTP <= 2.9.9 - Authenticated (Administrator+) SQL Injection	November 15, 2024	2.9.10	Medium
`*-2.9.3`	POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection	May 22, 2024	2.9.4	High
`*-2.8.7`	POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API	January 10, 2024	2.8.8	Critical
`*-2.8.7`	POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device	January 2, 2024	2.8.8	High
`*-2.8.6`	POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg	January 2, 2024	2.8.7	Medium
`*-2.8.6`	POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.6 - Authenticated (Administrator+) SQL Injection	December 21, 2023	2.8.7	High
`*-2.7.0`	POST SMTP Mailer <= 2.7.0 - Unauthenticated Stored Cross-Site Scripting	November 6, 2023	2.7.1	High
`[*, 2.6.1)`	Post SMTP <= 2.6.0 - Authenticated (Administrator+) SQL Injection	October 3, 2023	2.6.1	High
`2.1.2-beta.1 - 2.5.7`	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get	July 18, 2023	2.5.9-beta.1	Medium
`*-2.5.7`	Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email	July 11, 2023	2.5.8	High
`*-2.5.6`	POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Arbitrary Log Deletion	June 26, 2023	2.5.7	Medium
`*-2.5.6`	POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Account Compromise	June 26, 2023	2.5.7	Medium
`*-2.1.6`	Post SMTP <= 2.1.6 - Authenticated (Administrator+) Blind Server-Side Request Forgery	September 5, 2022	2.1.7	Medium
`*-2.1.3`	Post SMTP Mailer/Email Log <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting	August 18, 2022	2.1.4	Medium

Selected source records

Latest Records

HighCVE-2026-48838

Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting

Published: May 28, 2026

Affected versions: *-3.6.2
Patched versions: 3.6.3

Original Wordfence record

MediumCVE-2024-13362

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Published: April 30, 2026

Affected versions: *-3.4.12
Patched versions: 3.4.15

Affected versions: *-2.2.2
Patched versions: 2.2.5

Affected versions: *-3.0.5
Patched versions: 3.0.7

Affected versions: *-2.3.1
Patched versions: 2.3.2

Affected versions: *-2.0.2
Patched versions: 2.0.3

Affected versions: *-1.3.4
Patched versions: Not supplied

Affected versions: *-1.2.7
Patched versions: 1.2.8

Affected versions: *-1.3.1
Patched versions: 1.3.5

Affected versions: *-2.9.2
Patched versions: 2.10.0

Affected versions: *-2.6.7
Patched versions: 2.7.0

Affected versions: *-4.6.8
Patched versions: 4.7.6

Affected versions: *-1.9.2
Patched versions: 1.9.3

Affected versions: *-1.6.22
Patched versions: 1.6.23

Affected versions: *-1.4.2
Patched versions: 1.4.3

Affected versions: *-2.1
Patched versions: 2.2

Affected versions: *-2.6.5
Patched versions: 2.6.7

Affected versions: *-2.2.27
Patched versions: 2.5.1

Affected versions: *-3.2.6
Patched versions: 3.2.8

Affected versions: *-5.17.2
Patched versions: 5.19.0

Affected versions: *-1.1.16
Patched versions: 1.1.17

Affected versions: *-2.5.8
Patched versions: 2.6.1

Affected versions: *-1.1.3
Patched versions: 1.1.10

Affected versions: *-2.5.5
Patched versions: 2.5.6

Affected versions: *-4.2.0
Patched versions: 4.2.1

Affected versions: *-3.0.2
Patched versions: 3.0.3

Affected versions: *-1.5.5
Patched versions: 1.6

Affected versions: *-1.2.56
Patched versions: 1.2.57

Affected versions: *-3.2.4
Patched versions: 3.2.5

Affected versions: *-2.4.1
Patched versions: 2.4.4

Affected versions: *-1.4.0
Patched versions: 1.4.1

Affected versions: *-1.6.3
Patched versions: 1.6.4

Affected versions: *-1.5.140
Patched versions: 1.5.141

Affected versions: *-2.6.0
Patched versions: 2.6.1

Affected versions: *-2.3.4
Patched versions: 2.3.5

Affected versions: *-2.5.7
Patched versions: 2.5.9

Affected versions: *-3.2.6
Patched versions: 3.2.9

Affected versions: *-1.7
Patched versions: Not supplied

Affected versions: *-2.1.6
Patched versions: 2.2.0

Affected versions: *-1.5.10
Patched versions: 1.6.2

Affected versions: *-2.0.7.2
Patched versions: 2.0.7.3

Affected versions: *-2.4.27
Patched versions: 2.4.29

Affected versions: *-3.12.1
Patched versions: 3.13.1

Affected versions: *-6.0.2
Patched versions: Not supplied

Affected versions: *-5.222
Patched versions: 5.225

Affected versions: *-1.1.5
Patched versions: 1.1.6

Affected versions: *-1.9.0
Patched versions: 1.10.0

Affected versions: *-1.4.7
Patched versions: Not supplied

Affected versions: *-1.4.9
Patched versions: 1.5.0

Affected versions: *-3.5.1
Patched versions: 3.5.2

Affected versions: *-2.16.3.3
Patched versions: 2.16.3.6

Affected versions: *-1.7.2
Patched versions: 1.8.5

Affected versions: *-5.0.57
Patched versions: 5.1.8

Affected versions: *-1.8.99
Patched versions: 2.3.17

Affected versions: *-3.0.0
Patched versions: 3.1.0

Affected versions: *-3.4.9
Patched versions: 3.4.11

Affected versions: *-2.1.34
Patched versions: 2.1.35

Affected versions: *-1.1.13
Patched versions: 1.1.17

Affected versions: *-1.7
Patched versions: Not supplied

Affected versions: *-5.5.8
Patched versions: 5.5.9

Affected versions: *-1.9.4
Patched versions: 1.9.7

Affected versions: *-1.10.4
Patched versions: 1.10.5.1

Affected versions: *-6.1.13
Patched versions: 6.1.14

Affected versions: *-2.9.7
Patched versions: 2.10.0

Affected versions: *-2.2.38
Patched versions: 2.2.39

Affected versions: *-3.12
Patched versions: 3.13

Affected versions: *-2.2.0
Patched versions: 2.3.1

Affected versions: *-2.3.7
Patched versions: 2.3.12

Affected versions: *-3.2.8
Patched versions: 3.2.9

Affected versions: *-2.3.0
Patched versions: 2.3.1

Affected versions: *-2.6.0
Patched versions: 2.10.0

Affected versions: *-2.07
Patched versions: 2.08

Affected versions: *-6.6.5
Patched versions: 6.6.6

Affected versions: *-3.9.6
Patched versions: 3.9.7

Affected versions: *-2.0.82
Patched versions: 2.0.83

Affected versions: *-3.3.2
Patched versions: 3.3.4

Affected versions: *-3.2.7
Patched versions: 3.2.9

Affected versions: *-3.2.4.4
Patched versions: 3.2.4.5

Affected versions: *-2.1.0
Patched versions: 2.2.0

Affected versions: *-1.7.0
Patched versions: 1.7.1

Affected versions: *-1.7.0
Patched versions: 1.7.1

Affected versions: *-2.5.9
Patched versions: 2.5.17

Affected versions: *-2.8.6
Patched versions: 2.8.7

Affected versions: *-1.6.3.2
Patched versions: 1.6.3.3

Affected versions: *-7.3.3
Patched versions: 7.3.4

Affected versions: *-1.0.40
Patched versions: 1.0.41

Affected versions: *-1.10.6
Patched versions: 1.10.8

Affected versions: *-2.4.2
Patched versions: 2.4.4

Affected versions: *-3.3.0
Patched versions: 3.3.2

Affected versions: *-3.3.7
Patched versions: 3.3.8

Affected versions: *-2.25.16
Patched versions: 2.25.19

Affected versions: *-2.0.0
Patched versions: 2.0.1

Affected versions: *-1.13.15
Patched versions: 1.13.16

Affected versions: *-1.6.0
Patched versions: 1.6.1

Affected versions: *-3.0.6
Patched versions: 3.0.7

Affected versions: *-3.2.2
Patched versions: 3.2.3

Affected versions: *-1.5.8
Patched versions: Not supplied

Affected versions: *-5.3.4
Patched versions: 5.4.0

Affected versions: *-3.8.3
Patched versions: 3.8.4

Affected versions: *-1.2.7
Patched versions: 1.2.9

Affected versions: *-2.7.33
Patched versions: 2.7.34

Affected versions: *-5.5.31
Patched versions: 5.5.32

Affected versions: *-2.5.9
Patched versions: 2.6.0

Affected versions: *-2.4.1
Patched versions: 2.4.3

Affected versions: *-4.4.1
Patched versions: 4.4.2

Affected versions: *-1.8.5
Patched versions: 1.9

Affected versions: *-1.16.3
Patched versions: 1.16.4

Affected versions: *-1.3.3
Patched versions: 1.3.4

Affected versions: *-2.3.11
Patched versions: Not supplied

Affected versions: *-1.8.4.8.1
Patched versions: 1.8.4.9.1

Affected versions: *-3.1.28
Patched versions: 3.2.2

Affected versions: *-8.0.7
Patched versions: 8.0.8

Affected versions: *-2.1.5
Patched versions: Not supplied

Affected versions: *-1.6.0
Patched versions: 1.6.5

Affected versions: *-1.9.8
Patched versions: 2.0.19

Affected versions: *-1.2.6
Patched versions: Not supplied

Affected versions: *-4.5.0
Patched versions: 4.5.1

Affected versions: *-1.0.4
Patched versions: 1.1

Affected versions: *-1.7.34
Patched versions: 1.8.12

Affected versions: *-6.1.10
Patched versions: 6.1.11

Affected versions: *-2.8.4
Patched versions: Not supplied

Affected versions: *-3.1.26
Patched versions: 3.1.28

Affected versions: *-3.12.0
Patched versions: 3.16.0

Affected versions: *-2.24.6
Patched versions: 2.25.2

Affected versions: *-7.7.0
Patched versions: 7.7.3

Affected versions: *-2.7.0
Patched versions: 2.7.7

Affected versions: *-3.7.3
Patched versions: Not supplied

Affected versions: *-3.2.7
Patched versions: 3.2.9

Affected versions: *-1.6.3
Patched versions: 1.6.6

Affected versions: *-1.9.0
Patched versions: 1.21.0

Affected versions: *-1.6.6
Patched versions: 1.7.5

Affected versions: *-1.5.8
Patched versions: 1.6.1

Original Wordfence record

MediumCVE-2026-2559

Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite

Published: March 17, 2026

Affected versions: *-3.8.0
Patched versions: 3.9.0

Original Wordfence record

HighCVE-2026-3090

Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'

Published: March 17, 2026

Affected versions: *-3.8.0
Patched versions: 3.9.0

Original Wordfence record

MediumCVE-2025-12887

Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update

Published: December 3, 2025

Affected versions: *-3.6.1
Patched versions: 3.6.2

Original Wordfence record

CriticalCVE-2025-11833

Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure

Published: October 31, 2025

Affected versions: *-3.6.0
Patched versions: 3.6.1

Original Wordfence record

MediumCVE-2025-9219

Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update

Published: September 2, 2025

Affected versions: *-3.4.1
Patched versions: 3.4.2

Original Wordfence record

HighCVE-2025-24000

Post SMTP <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via Email Log Exposure

Published: July 21, 2025

Affected versions: *-3.2.0
Patched versions: 3.3.0

Original Wordfence record

Highest-Severity Records

CriticalCVE-2025-11833

Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure

Published: October 31, 2025

Affected versions: *-3.6.0
Patched versions: 3.6.1

Original Wordfence record

CriticalCVE-2023-6875

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API

Published: January 10, 2024

Affected versions: *-2.8.7
Patched versions: 2.8.8

Original Wordfence record

HighCVE-2025-24000

Post SMTP <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via Email Log Exposure

Published: July 21, 2025

Affected versions: *-3.2.0
Patched versions: 3.3.0

Original Wordfence record

HighCVE-2024-5207

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection

Published: May 22, 2024

Affected versions: *-2.9.3
Patched versions: 2.9.4

Original Wordfence record

HighCVE-2025-0521

Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting

Published: February 17, 2025

Affected versions: *-3.0.2
Patched versions: 3.1.0

Original Wordfence record

High

Post SMTP <= 2.6.0 - Authenticated (Administrator+) SQL Injection

Published: October 3, 2023

Affected versions: [*, 2.6.1)
Patched versions: 2.6.1

Original Wordfence record

HighCVE-2026-3090

Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'

Published: March 17, 2026

Affected versions: *-3.8.0
Patched versions: 3.9.0

Original Wordfence record

HighCVE-2023-3082

Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email

Published: July 11, 2023

Affected versions: *-2.5.7
Patched versions: 2.5.8

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory