Is WP Mail SMTP safe?

Plugin details

• Slug: wp-mail-smtp
• Requires PHP: 7.4+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

• WP Mail SMTP by WPForms &#8211; The Most Popular SMTP and Email Log Plugin [wp-mail-smtp] < 1.4.0 [WordPress WP Mail SMTP by WPForms plugin <= 1.3.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability]
• WP Mail SMTP by WPForms &#8211; The Most Popular SMTP and Email Log Plugin [wp-mail-smtp] < 1.4.0 [WP Mail SMTP by WPForms <= 1.3.3 - Unspecified Cross-Site Scripting]
• WP Mail SMTP by WPForms &#8211; The Most Popular SMTP and Email Log Plugin [wp-mail-smtp] < 1.4.0 [WP Mail SMTP by WPForms &lt;= 1.3.3 - Authenticated Stored Cross-Site Scripting (XSS)]
• WP Mail SMTP by WPForms &#8211; The Most Popular SMTP and Email Log Plugin [wp-mail-smtp] < 4.1.0 [CVE-2024-6694, WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure, WordPress WP Mail SMTP by WPForms Plugin <= 4.0.1 is vulnerable to Sensitive Data Exposure]

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

• MC4WP: Mailchimp for WordPress — 1000000+ active installs — max PHP 8.4
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more — 500000+ active installs — max PHP 8.4
• Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App — 300000+ active installs — max PHP 8.4
• WP Mail Logging — 300000+ active installs
• Mailchimp for WooCommerce — 200000+ active installs — max PHP 8.4