CVE-2025-28974: MAIL250 Free Wp Mail Smtp

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Cross-Site Request Forgery (CSRF) vulnerability in mail250 Free WP Mail SMTP free-wp-mail-smtp allows Stored XSS.This issue affects Free WP Mail SMTP: from n/a through <= 1.0.

Affected products

• MAIL250 Free Wp Mail Smtp: up to and including 1.0

Published 2025-06-06. Last modified 2026-06-17.