CVE-2019-20204: Postieplugin Postie

Medium severity, CVSS 5.4. EPSS: 3.4% chance of exploitation in the next 30 days.

The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.

Affected products

• Postieplugin Postie: up to and including 1.9.40

Published 2020-01-02. Last modified 2026-06-17.