This vulnerability (CVE-2026-48838) is an unauthenticated Cross-Site Scripting (XSS) issue in the Post SMTP plugin by WPExperts, affecting versions up to and including 3.6.2. The flaw arises from improper neutralization of input during web page generation, categorized under CWE-79. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation allows unauthenticated attackers to inject malicious scripts into web pages generated by the plugin, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. This could enable actions such as session hijacking, defacement, or other malicious activities that rely on executing arbitrary scripts in the context of the victim's browser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure by restricting access to affected plugin functionality or applying web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin.