CVE-2026-16636

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via an attacker-controlled recipient display name (to.name) in a wp_mail() call and does not fire in the log list view — only in the detail view when an administrator uses the Prev/Next navigation controls, as that path bypasses the escapeHtml pipeline used by the list view.

• CWE-79

• https://plugins.trac.wordpress.org/browser/fluent-smtp/tags/2.2.95/app/Models/Logger.php#L165
• https://plugins.trac.wordpress.org/browser/fluent-smtp/tags/2.2.95/app/Models/Logger.php#L310
• https://plugins.trac.wordpress.org/browser/fluent-smtp/tags/2.2.95/app/Services/Mailer/BaseHandler.php#L290
• https://plugins.trac.wordpress.org/browser/fluent-smtp/tags/2.2.95/app/Services/Mailer/BaseHandler.php#L357
• https://plugins.trac.wordpress.org/browser/fluent-smtp/tags/2.2.95/assets/admin/js/fluent-mail-admin-app.js
• https://plugins.trac.wordpress.org/changeset/3635135/fluent-smtp/trunk/assets/admin/js/fluent-mail-admin-app.js
• https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluent-smtp/tags/2.2.95&new_path=%2Ffluent-smtp/tags/2.3.0
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3635135%40fluent-smtp%2Ftags%2F2.3.0&old=3428610%40fluent-smtp%2Ftags%2F2.2.95
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4ad3ed6b-19d4-47c7-a56c-54092c767fe9?source=cve

Published

Aug 6, 2026

Last Modified

Aug 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16630A security vulnerability has been detected in syncfusion ej2…5.3
• CVE-2026-16631A vulnerability was detected in publint up to 0.1.4. This im…5.3
• CVE-2026-16632A flaw has been found in boazsegev facil.io up to 0.7.4. Aff…7.3
• CVE-2026-16633### Impact If PDF.js is used to load a malicious PDF, and P…8.6
• CVE-2026-16634TOML::XS versions before 0.06 for Perl bundle an unsupported…9.8
• CVE-2026-16635The Pronamic Pay plugin for WordPress is vulnerable to Privi…8.8
• CVE-2026-16637OPeNDAP Hyrax allows SSRF and credential disclosure via unva…6.5
• CVE-2026-1664Summary An Insecure Direct Object Reference has been found …6.9
• CVE-2026-1665A command injection vulnerability exists in nvm (Node Versio…5.4
• CVE-2026-16653A security flaw has been discovered in boazsegev facil.io up…5.5
• CVE-2026-16655The Fluent Forms – Customizable Contact Forms, Survey, Quiz,…7.2
• CVE-2026-1666The Download Manager plugin for WordPress is vulnerable to R…6.1