CVE-2026-16636

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via an attacker-controlled recipient display name (to.name) in a wp_mail() call and does not fire in the log list view — only in the detail view when an administrator uses the Prev/Next navigation controls, as that path bypasses the escapeHtml pipeline used by the list view.

• CWE-79

• https://plugins.trac.wordpress.org/browser/fluent-smtp/tags/2.2.95/app/Models/Logger.php#L165
• https://plugins.trac.wordpress.org/browser/fluent-smtp/tags/2.2.95/app/Models/Logger.php#L310
• https://plugins.trac.wordpress.org/browser/fluent-smtp/tags/2.2.95/app/Services/Mailer/BaseHandler.php#L290
• https://plugins.trac.wordpress.org/browser/fluent-smtp/tags/2.2.95/app/Services/Mailer/BaseHandler.php#L357
• https://plugins.trac.wordpress.org/browser/fluent-smtp/tags/2.2.95/assets/admin/js/fluent-mail-admin-app.js
• https://plugins.trac.wordpress.org/changeset/3635135/fluent-smtp/trunk/assets/admin/js/fluent-mail-admin-app.js
• https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluent-smtp/tags/2.2.95&new_path=%2Ffluent-smtp/tags/2.3.0
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3635135%40fluent-smtp%2Ftags%2F2.3.0&old=3428610%40fluent-smtp%2Ftags%2F2.2.95
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4ad3ed6b-19d4-47c7-a56c-54092c767fe9?source=cve

Published

Aug 6, 2026

Last Modified

Aug 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16630A security vulnerability has been detected in syncfusion ej2…5.3
• CVE-2026-16631A vulnerability was detected in publint up to 0.1.4. This im…5.3
• CVE-2026-16632A flaw has been found in boazsegev facil.io up to 0.7.4. Aff…7.3
• CVE-2026-16633### Impact If PDF.js is used to load a malicious PDF, and P…8.6
• CVE-2026-16634TOML::XS versions before 0.06 for Perl bundle an unsupported…9.8
• CVE-2026-16635The Pronamic Pay plugin for WordPress is vulnerable to Privi…8.8
• CVE-2026-16637OPeNDAP Hyrax allows SSRF and credential disclosure via unva…6.5
• CVE-2026-16638Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-16639Authentication Bypass Using an Alternate Path or Channel vul…9.8
• CVE-2026-1664Summary An Insecure Direct Object Reference has been found …6.9
• CVE-2026-16640Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-16641Vulnerability in Drupal Commerce Elavon. This issue affects …9.8