CVE-2026-3090
Stored XSS in Post SMTP WordPress Plugin via event_type Parameter
Publication date: 2026-03-18
Last updated on: 2026-03-18
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| post_smtp | post_smtp | to 3.8.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Post SMTP WordPress plugin, up to version 3.8.0, has a Stored Cross-Site Scripting (XSS) vulnerability via the 'event_type' parameter. This occurs because the plugin does not properly sanitize or escape input and output related to this parameter. An unauthenticated attacker can inject malicious web scripts that execute whenever a user views the affected page. However, this vulnerability is only exploitable if the Post SMTP Pro plugin is installed and its Reporting and Tracking extension is enabled.
How can this vulnerability impact me? :
This vulnerability allows attackers to inject arbitrary scripts into the plugin's pages, which execute in the context of users who access those pages. This can lead to theft of user credentials, session hijacking, or other malicious actions performed on behalf of the user without their consent. Since the vulnerability is exploitable without authentication, it poses a significant risk to site administrators and users who interact with the plugin's reporting and tracking features.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "The vulnerability involves Stored Cross-Site Scripting via the 'event_type' parameter in the Post SMTP WordPress plugin versions up to 3.8.0, exploitable only when the Post SMTP Pro plugin with its Reporting and Tracking extension is enabled."}, {'type': 'paragraph', 'content': "Detection would involve inspecting the 'event_type' parameter in HTTP requests or stored data related to the Post SMTP plugin to identify injected scripts."}, {'type': 'paragraph', 'content': "Since the plugin stores email logs in database tables named 'post_smtp_logs' and 'post_smtp_logmeta', examining these tables for suspicious script tags or unusual content in the 'event_type' field or related log entries could help detect exploitation."}, {'type': 'paragraph', 'content': 'No explicit commands are provided in the resources, but general approaches include:'}, {'type': 'list_item', 'content': "Using SQL queries to search for script tags or suspicious content in the plugin's database tables, e.g., `SELECT * FROM post_smtp_logs WHERE event_type LIKE '%<script>%'`."}, {'type': 'list_item', 'content': "Monitoring HTTP requests to the WordPress site for suspicious parameters in URLs or POST data involving 'event_type'."}, {'type': 'list_item', 'content': 'Using WordPress security plugins or web application firewalls that can detect XSS payloads in requests or stored content.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary mitigation is to update the Post SMTP WordPress plugin to version 3.9.0 or later, as this version addresses multiple improvements and likely fixes related to the vulnerability.'}, {'type': 'paragraph', 'content': "If updating immediately is not possible, consider disabling the Post SMTP Pro plugin's Reporting and Tracking extension, as the vulnerability is only exploitable when this extension is enabled."}, {'type': 'paragraph', 'content': "Additionally, restrict access to the plugin's email logs and related interfaces to trusted users only, as the plugin enforces capability checks to manage log viewing, deletion, and export."}, {'type': 'paragraph', 'content': "Ensure that any input parameters, especially 'event_type', are sanitized and that your WordPress installation uses security best practices such as nonce verification and user capability restrictions."}] [1, 3]