An unauthenticated Cross Site Scripting vulnerability exists in the WordPress Post SMTP plugin versions up to 3.6.2. An attacker can inject arbitrary client‑side scripts by supplying crafted input to the plugin’s features, which may lead to theft of user credentials, session hijacking, defacement, or other malicious actions executed in the victim’s browser. The weakness is a classic input validation flaw (CWE‑79). The plugin accepts input that is ultimately reflected in web pages without proper sanitization, giving an attacker the ability to execute code in the context of any site using the plugin.

The affected product is the WordPress Post SMTP plugin developed by WPExperts. All installations running versions 3.6.2 or earlier are vulnerable. The problem does not affect other WordPress plugins, themes, or core files directly.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% shows a low estimated probability of exploitation observed so far. The vulnerability is not listed in the CISA KEV catalog, implying no widespread public exploits are known. The likely attack vector is unauthenticated exploitation via crafted input to the plugin’s configuration or functionality, as the flaw does not require login credentials. If an attacker succeeds, they can run arbitrary JavaScript in the browsers of any visitors to the affected site, compromising confidentiality, integrity, or availability of the website’s content and potentially the host environment.