CVE-2026-48838: WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected or stored cross-site scripting (XSS) affects the Post SMTP WordPress plugin by WPExperts at versions 3.6.2 and below. The vulnerability is reachable over the network without any account or login, but requires a victim to interact with a crafted link or page. Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser, enabling session theft, page content manipulation, and redirection. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected WordPress instance over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or login is needed; the vulnerability is exploitable by any unauthenticated user.

• Victim interactionRequired

  A victim must take an action such as clicking a crafted link or visiting a malicious page for the injected script to execute in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup beyond delivering the payload to a victim.

Blast Radius

• Attacker executes arbitrary JavaScript in the authenticated victim's browser session, enabling theft of session cookies or authentication tokens.
• Attacker can modify the visible content of the WordPress admin or front-end page the victim is viewing, facilitating phishing or credential harvesting.
• Attacker can redirect the victim's browser to an external site of the attacker's choosing.
• With the scope change token (S:C) in the CVSS vector, impact extends beyond the plugin itself and can affect other components of the WordPress environment loaded in the same browser context.