Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-100175— Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink

Quick assessment

Affected

wayneallen-1 Postie

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Postie 插件在所有 1.9.87 及更早版本中，存在通过电子邮件正文中的 URL 自动链接功能导致的存储型跨站脚本（Stored XSS）漏洞。该漏洞源于输入数据净化不足以及输出转义缺失，使得未经认证的攻击者能够向页面注入任意 Web 脚本；一旦用户访问被注入的页面，这些脚本便会执行。此漏洞之所以可行，是因为端点可被未经认证的用户直接访问，且未进行任何权限检查；同时，邮件处理流程在保存原始标记之前移除了 WordPress 的 kses 输出过滤机制，导致未经转义的属性值被直接存

CVSS 5.4 · Medium EPSS 0.33% · P26 Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
wayneallen-1	Postie	`≤ 1.9.87`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink

Source: CVE Program / CVE List V5

Vulnerability Description

The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up to, and including, 1.9.87 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the ?postie=get-mail endpoint is reachable by unauthenticated users with no capability check, and the email processing path removes WordPress's kses output filters before saving raw markup, allowing the unescaped href attribute value to be stored as post content.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
wayneallen-1	Postie	0 ~ 1.9.87	-

II. Public POCs for CVE-2026-100175

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-100175

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-100175 (1)

🔗 Changeset 3751269 – WordPress Plugin Repository Read full article

Vendor Advisories for CVE-2026-100175 (1)

🔗 Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink

Vendor Pages for CVE-2026-100175 (2)

Other References for CVE-2026-100175 (3)

https://www.cve.org/CVERecord?id=CVE-2026-100175

IV. Related Vulnerabilities

Same product: Postie

Same weakness: CWE-79