CVE-2026-75962

Name of the Vulnerable Software and Affected Versions Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App versions prior to 4.0.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the user email parameter. On WordPress Multisite installations with public registration enabled, attackers can use email addresses containing numeric HTML character references. While the plugin's validator rejects these, the attacker-controlled address is persisted verbatim to the email log through the failed-send exception message, executing the script when a user accesses the affected page.

Recommendations Update to version 4.0.2 or later. As a temporary mitigation, restrict public registration on WordPress Multisite installations to prevent unauthenticated users from triggering the vulnerability via the user email parameter.