plugin

Twinklesmtp Vulnerabilities

2 known security issues reported for the Twinklesmtp WordPress plugin. Most recent disclosed Jan 7, 2026.

1 medium

Running Twinklesmtp on your site? Check whether your installed version is affected.

Scan your site free

twinklesmtp &#8211; Email Service Provider For WordPress [twinklesmtp] <= 1.03 (unfixed)

unknown

[en] The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admin...

Affected:
up to 1.03
Fix:
No patched version reported
Disclosed:
Jan 7, 2026

CVE-2025-14887 on NVD →

twinklesmtp – Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings

medium

The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administra...

CVSS:
4.4
Affected:
up to 1.03
Fix:
No patched version reported
Disclosed:
Jan 6, 2026

CVE-2025-14887 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database