Postie Vulnerabilities

The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.9.73 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil...

CVSS:

6.4

Affected:

up to 1.9.73

Fixed in:

1.9.74

Disclosed:

Dec 31, 2025

CVE-2025-63020 on NVD →

The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.9.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary...

CVSS:

4.4

Affected:

up to 1.9.70

Fixed in:

1.9.71

Disclosed:

Sep 8, 2025

CVE-2024-5200 on NVD →

The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.

CVSS:

5.4

Affected:

up to 1.9.41

Fixed in:

1.9.41

Disclosed:

Jan 2, 2020

CVE-2019-20204 on NVD →

The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.

CVSS:

5.3

Affected:

up to 1.9.41

Fixed in:

1.9.41

Disclosed:

Jan 2, 2020

CVE-2019-20203 on NVD →

Cross-site scripting (XSS) vulnerability in the Postie plugin before 1.4.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the From field of an email. A partial fix was deployed in version 1.4.4 but this was easily bypassed.

CVSS:

7.2

Affected:

up to 1.4.9

Fixed in:

1.4.10

Disclosed:

Aug 8, 2012

CVE-2012-2580 on NVD →