Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

Vulnerabilities 34Slug post-smtpLatest version 3.9.1WordPress.org →

Minimum safe version

3.9.0

Update to 3.9.0 or later to address 34 fixable vulnerabilities

Latest available3.9.1 ✓
Medium 4.3
2025-09-03< 3.4.2

Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update

EUVDWordfenceCVE
N/A
2026-03-17< 3.9.0

Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite

WordfenceCVE
N/A
2026-03-17< 3.9.0

Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'

WordfenceCVE
Medium 5.3
2025-12-09< 3.6.2

CVE-2025-67563

CVE
High 7.2
2025-02-18< 3.1.0

Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting

EUVDWordfenceCVE
Medium 6.1
2024-01-03< 2.8.7

CVE-2023-6621

CVEWPScan
N/A
< 2.6.1

Post SMTP &lt; 2.6.1 - Authenticated (Administrator+) SQL Injection

WPScan
N/A
2023-10-04< 2.6.1

WordPress Post SMTP Mailer/Email Log Plugin < 2.6.1 is vulnerable to SQL Injection

Patchstack
N/A
2023-10-03< 2.6.1

Post SMTP <= 2.6.0 - Authenticated (Administrator+) SQL Injection

Wordfence
N/A
2023-07-18< 2.5.8

WordPress Post SMTP Mailer/Email Log Plugin < 2.5.8 is vulnerable to Cross Site Scripting (XSS)

PatchstackWPScanCVE
N/A
2023-06-07< 2.0.21

CVE-2021-4342

CVE
N/A
< 2.0.21

Various Affected Software (Various Versions) - Cross-Site Request Forgery Bypass

Wordfence
N/A
2021-02-11< 2.0.21

WordPress Post SMTP Mailer/Email Log plugin <= 2.0.20 - Cross-Site Request Forgery (CSRF) nonce validation vulnerability

Patchstack