Vulnerabilities

TI-2026-06704 CVE-2026-7621 · GHSA-j6m5-8x48-22mr

SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate

LOW 20

The SMTP2GO for WordPress – Email Made Easy plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.16.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0025 Published 2026-05-28 No fix listed CWE-862

TI-2025-33856 CVE-2025-54011 · GHSA-g6rq-pxq3-m464

WordPress SMTP2GO plugin <= 1.12.1 - Broken Access Control Vulnerability

LOW 20

Missing Authorization vulnerability in SMTP2GO SMTP2GO smtp2go allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMTP2GO: from n/a through <= 1.12.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00232 Published 2025-07-16 No fix listed CWE-862

TI-2023-13036 CVE-2023-28496 · GHSA-793w-76jj-j598

WordPress SMTP2GO Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SMTP2GO – Email Made Easy plugin <= 1.4.2 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-06-22 No fix listed CWE-79

Vulnerabilities

Filters

SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate

WordPress SMTP2GO plugin <= 1.12.1 - Broken Access Control Vulnerability

WordPress SMTP2GO Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)