CVE-2026-16636

Name of the Vulnerable Software and Affected Versions FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider versions prior to 2.2.96

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs in the Email Logs detail view when an administrator uses the Prev/Next navigation controls, as this specific path bypasses the escapeHtml pipeline. The malicious payload is delivered through the to.name variable within a wp mail() function call.

Recommendations Update FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider to version 2.2.96 or later.