FluentSMTP <= 2.2.95 Unauthenticated Stored XSS via Email Logs (CVE-2026-16636)

Vulnerability Overview Vulnerability Name: FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to name) in Email Logs CVE ID: CVE-2026-16636 CVSS Score: 7.2 (High) Release Date: August 5, 2026 Last Updated: August 6, 2026 Researchers: Fraudless - Fraudless.tech Scope of Impact Software Type: Plugin Software Name: FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP Software Version: <= 2.2.95 Affected Versions: <= 2.2.95 Remediation Recommendation: Update to version 2.3.0 or later patched versions Patched Version: 2.3.0 Detailed Description The FluentSMTP plugin for WordPress, which supports Amazon SES, SendGrid, Mailgun, Postmark, Google, and any SMTP provider, is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to name) in Email Logs in all versions up to and including 2.2.95 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute whenever a user accesses the affected page. The payload is delivered via an attacker-controlled recipient display name (to name) in a call. The exploit does not trigger in the log list view; it only fires in the detail view when an administrator uses the Prev/Next navigation controls, as this path bypasses the pipeline used by the list view. References plugins.trac.wordpress.org Additional Information Disclaimer: This record contains copyrighted material. Copyright: 2012-2026 Defiant Inc. MITRE Corporation Copyright: 1999-2026 The MITRE Corporation Contact Information Technical Support: 24-hour support, year-round, with a 1-hour response time. Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). Other Vulnerabilities FluentSMTP <= 2.2.80 - Cross-Site Request Forgery - CVE ID: CVE-2025-24739 - CVSS Score: 4.3 - Researcher: Rafie Muhammad - Release Date: January 24, 2025 FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Google and Any SMTP Provider <= 2.2.82 - Unauthenticated PHP Object Injection - CVE ID: CVE-2024-9511 - CVSS Score: 9.8 - Researcher: Leo - Release Date: November 22, 2024 FluentSMTP <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject - CVE ID: CVE-2023-3087 - CVSS Score: 7.2 - Researcher: Alex Thomas - Release Date: July 6, 2023 FluentSMTP <= 2.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Email Logs - CVE ID: CVE-2023-0219 - CVSS Score: 3.8 - Researcher: Vaibhav Ragup - Release Date: March 3, 2023 FluentSMTP <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting - CVE ID: CVE-2021-24528 - CVSS Score: 5.5 - Researcher: YoshiKen - Release Date: July 29, 2021 Summary The FluentSMTP plugin contains an unauthenticated stored cross-site scripting vulnerability in versions <= 2.2.95. Attackers can inject malicious scripts by controlling the recipient display name. It is recommended that users update to version 2.3.0 or higher as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

FluentSMTP <= 2.2.95 Unauthenticated Stored XSS via Email Logs (CVE-2026-16636)

More from this source