CVE-2026-16636 is a stored cross-site scripting vulnerability in the FluentSMTP – WP SMTP Plugin for WordPress, affecting all versions up to and including 2.2.95. The vulnerability is caused by improper neutralization of input during web page generation (CWE-79), specifically in the handling of the recipient display name (to.name) within email logs. An attacker can inject malicious scripts via the recipient display name in a wp_mail() call. These scripts execute when an administrator navigates email log details using Prev/Next controls, bypassing the usual HTML escaping applied in the list view. This vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact. The plugin is a cloud service, and a patch is available.

An unauthenticated attacker can inject and execute arbitrary JavaScript in the context of an administrator's browser when viewing detailed email logs. This can lead to confidentiality and integrity impacts such as session hijacking or unauthorized actions performed with administrator privileges. There is no impact on availability. The vulnerability affects all users of the plugin up to version 2.2.95, potentially exposing administrative users to targeted attacks via crafted recipient display names.

A patch is available for this vulnerability. Since the product is a cloud service, the vendor manages remediation on the server side. Administrators should verify that their FluentSMTP plugin is updated beyond version 2.2.95 or confirm with the vendor that the service has been patched. No additional mitigation steps are required if the patch is applied.