CVE-2023-7027: saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app Cross-site Scripting

EPSS trend

Probability

0.94%

Chance of exploitation in the next 30 days

Percentile

61%

Versus all other CVEs

30-day change

0.00 pp

From 0.94% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.94%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (plugins.trac.wordpress.org)
Maturity: unknown
referenceUnverified
Exploit Reference (plugins.trac.wordpress.org)
Maturity: unknown

References

6 links

www.wordfence.com/threat-intel/vulnerabilities/id/7e8911a3-ce0f-420c-bf2a-1c2929d01cef?source=cveThird Party Advisory
plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.phpExploit
plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/mobile.phpExploit
plugins.trac.wordpress.org/changesetPatch
packetstormsecurity.com/files/…X TransferredThird Party AdvisoryVDB Entry
www.wordfence.com/threat-intel/vulnerabilities/id/7e8911a3-ce0f-420c-bf2a-1c2929d01cefVendor Advisory

Related vulnerabilities

CVE-2021-4422saadiqbalpost smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app+20.54%3y ago12-07-2023 06:52The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2025-11833saadiqbalpost smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app+161.48%11mo ago01-11-2025 03:34The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.CVE-2025-0521saadiqbalpost smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app+20.33%1y ago18-02-2025 11:10The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-9219saadiqbalpost smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app+10.25%1y ago03-09-2025 08:27The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback' function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions.CVE-2025-22800saad iqbalpost smtp+20.40%1y ago13-01-2025 13:11Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 2.9.11.CVE-2025-24000saad iqbalpost smtp+10.60%1y ago07-08-2025 16:58Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through <= 3.2.0.

All vulnerabilities inpost smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app post_smtp

CVE-2023-7027: saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app Cross-site Scripting

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References