CVE-2026-16636: FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via an attacker-controlled recipient display name (to.name) in a wpmail() call and does not fire in the log list view — only in the detail view when an administrator uses the Prev/Next navigation controls, as that path bypasses the escapeHtml pipeline used by the list view.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update FluentSMTP to a version that fixes Stored XSS in email logs by ensuring recipient display names from wp_mail() are sanitized and safely escaped before being rendered in both list and detail views.
FluentSMTP – WP SMTP Plugin Recipient display name (to.name) handling in email logs = Ensure proper input sanitization and output escaping on all log views (including detail/Prev/Next navigation)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16636?
The severity of CVE-2026-16636 is high, with a score of 7.2.
How do I fix CVE-2026-16636?
To fix CVE-2026-16636, update FluentSMTP to a version beyond 2.2.95.
What type of vulnerability is CVE-2026-16636?
CVE-2026-16636 is an unauthenticated stored cross-site scripting (XSS) vulnerability.
What products are affected by CVE-2026-16636?
CVE-2026-16636 affects all versions of the FluentSMTP – WP SMTP Plugin for WordPress up to and including 2.2.95.
Can CVE-2026-16636 be exploited remotely?
Yes, CVE-2026-16636 can be exploited remotely due to the unauthenticated nature of the stored XSS vulnerability.