CVE-2026-75962: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in saadiqbal Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

CVE-2026-75962 is a stored cross-site scripting vulnerability in the Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App WordPress plugin. The vulnerability is due to improper neutralization of input in the 'user_email' parameter, allowing unauthenticated attackers to inject arbitrary web scripts. This occurs because the plugin fails to properly sanitize and escape input before storing it in email logs, especially on WordPress Multisite setups with public registration enabled. Attackers can exploit this by submitting email addresses containing numeric HTML character references that bypass the plugin's stricter validation but are accepted by WordPress, resulting in persistent script injection in the email logs.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of users viewing the affected email logs. This can lead to information disclosure or other client-side impacts. The vulnerability has a CVSS 3.1 score of 7.2 (High), indicating significant risk due to network attack vector, no privileges required, no user interaction, and impact on confidentiality and integrity with scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators of WordPress Multisite installations with public registration enabled should consider disabling public registration or restricting access to email logs to trusted users only to mitigate exploitation risk.