High
CVE-2026-75962
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 28
Reset filters
Medium
CVE-2026-81278
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 4.0.0-beta.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change
High
CVE-2026-48838
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
High
CVE-2026-3090
Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'
Medium
CVE-2026-2559
Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite
Medium
CVE-2025-12887
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update
Critical
CVE-2025-11833
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure
Medium
CVE-2025-9219
Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update
High
CVE-2025-24000
Post SMTP <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via Email Log Exposure
Medium
CVE-2024-13844
Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter
High
CVE-2025-0521
Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-22800
Post SMTP <= 2.9.11 - Missing Authorization via regenerate_qrcode()
Medium
CVE-2024-52436
Post SMTP <= 2.9.9 - Authenticated (Administrator+) SQL Injection
High
CVE-2024-5207
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection
Critical
CVE-2023-6875
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
High
CVE-2023-7027
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device
Medium
CVE-2023-6629
POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg
High
CVE-2023-6620
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.6 - Authenticated (Administrator+) SQL Injection
High
CVE-2023-5958
POST SMTP Mailer <= 2.7.0 - Unauthenticated Stored Cross-Site Scripting
High
3816a6cf-8157-4ad9-83f6-93c9b6c6275f
Post SMTP <= 2.6.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2023-33999
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
High
CVE-2023-3082
Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email
Medium
CVE-2023-3178
POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Arbitrary Log Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.