An unauthenticated attacker can inject JavaScript code through the 'event_type' parameter in the Post SMTP plugin. Because the input is not adequately sanitized or escaped, the malicious code becomes stored and executed within WordPress pages that display the event logs. This stored XSS can lead to data theft, session hijacking, defacement, or the installation of malware for any visitor who loads the compromised page. The weakness is identified as CWE‑79 – Improper Neutralization of Input During Web Page Generation.

The vulnerability affects all versions of the Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin released by saadiqbal for WordPress that are version 3.8.0 or earlier. It only exists when the Post SMTP Pro extension is present and its Reporting and Tracking component is turned on, because that is where the vulnerable code path is executed.

CVSS base score is 7.2, indicating a high‑impact threat. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The attack requires unauthenticated access to the WordPress installation, the presence of the Pro plugin, and the Reporting/Tracking feature enabled. An attacker may craft a malicious 'event_type' payload, store it through the plugin’s interface, and then wait for other users to view the affected page, where the script will run in their browsers. Due to these constraints, the likelihood of immediate exploitation is moderate, but the impact remains significant; patching is strongly recommended.