CVE-2022-2351: Wpexperts Post Smtp

Medium severity, CVSS 4.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.

Affected products

• Wpexperts Post Smtp: before 2.1.4 (fixed in 2.1.4)

Published 2022-09-16. Last modified 2026-06-17.