Postmarkapp Email Integrator Vulnerabilities

The PostmarkApp Email Integrator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 2.4. This is due to insufficient input sanitization and output escaping on the pma_api_key and pma_sender_address parameters. This makes it possible for authentica...

CVSS:

4.4

Affected:

up to 2.4

Fixed in:

2.5.0

Disclosed:

Feb 18, 2026

CVE-2026-1043 on NVD →

The PostmarkApp Email Integrator plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.4

Fixed in:

2.5.0

Disclosed:

Mar 31, 2025

CVE-2025-31576 on NVD →

The PostmarkApp Email Integrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a...

CVSS:

4.3

Affected:

up to 2.4

Fixed in:

2.5.0

Disclosed:

Mar 31, 2025

CVE-2025-31617 on NVD →

[en] Missing Authorization vulnerability in Gagan Deep Singh PostmarkApp Email Integrator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PostmarkApp Email Integrator: from n/a through 2.4.

Affected:

up to 2.4

Fix:

No patched version reported

Disclosed:

Mar 31, 2025

CVE-2025-31576 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Gagan Deep Singh PostmarkApp Email Integrator allows Cross Site Request Forgery. This issue affects PostmarkApp Email Integrator: from n/a through 2.4.

Affected:

up to 2.4

Fix:

No patched version reported

Disclosed:

Mar 31, 2025

CVE-2025-31617 on NVD →