A critical stored Cross-Site Scripting vulnerability in the Post SMTP plugin for WordPress allows unauthenticated attackers to execute arbitrary web scripts in affected environments.

This flaw is a stored Cross-Site Scripting (CWE-79) vulnerability occurring via the event_type parameter. It requires the Post SMTP Pro plugin to be installed with the Reporting and Tracking extension enabled, and it permits unauthenticated attackers to inject malicious scripts that execute when a user views the logs.

Successful exploitation allows an unauthenticated attacker to inject malicious JavaScript, which could lead to unauthorized actions, session hijacking, or the theft of sensitive administrative data from users viewing the logs. With a CVSS score of 7.2, this vulnerability represents a high risk to organizational security, particularly for WordPress sites managing sensitive email communication and logs.

Immediate Action: Update the Post SMTP plugin to version 3.8.1 or later immediately to apply the necessary input sanitization and output escaping patches.

Proactive Monitoring: Monitor WordPress administrative logs for suspicious entries or unauthorized configuration changes within the Post SMTP plugin settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block malicious script injection patterns targeting the event_type parameter until the update is applied.

Public Exploit Available: No (exploit_available: false)

Given the high severity and the ability for unauthenticated actors to execute client-side code, administrators should treat this vulnerability with urgency. Ensure the plugin is updated to the patched version across all instances to prevent potential site compromise and unauthorized access to administrative sessions.