CVE-2026-3090

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_type’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when the Post SMTP Pro plugin is also installed and its Reporting and Tracking extension is enabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/PostmanEmailLogs.php#L459
• https://plugins.trac.wordpress.org/changeset/3484515/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8cbbbb-2089-4966-8fd3-da4f76fb2517?source=cve

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30893Wazuh is a free and open source platform used for threat pre…9.9
• CVE-2026-30894Lack of output escaping leads to a XSS vector in the content…6.1
• CVE-2026-30895Lack of output escaping leads to a XSS vector in the readmor…6.1
• CVE-2026-30896The installer for Qsee Client versions 1.0.1 and prior insec…8.4
• CVE-2026-30897A stack-based buffer overflow vulnerability in Fortinet Fort…6.6
• CVE-2026-30898An example of BashOperator in Airflow documentation suggeste…8.8
• CVE-2026-30900Improper Check of minimum version in update functionality of…7.8
• CVE-2026-30901Improper Input Validation in Zoom Rooms for Windows before 6…7.8
• CVE-2026-30902Improper Privilege Management in certain Zoom Clients for Wi…7.8
• CVE-2026-30903External Control of File Name or Path in the Mail feature of…9.8
• CVE-2026-30904Protection Mechanism Failure in Zoom Workplace for iOS befor…4.3
• CVE-2026-30905External Control of File Name or Path in the Zoom Workplace …7.8