Critical and high severity vulnerabilities over and over again
We’ve been using Post SMTP for years. Initially, we started with WP Mail SMTP, but the free version didn’t include logging, while Post SMTP did, and that occasionally came in handy. So we switched to Post SMTP across all our projects. About two years ago, several websites we manage were hacked due to a vulnerability in Post SMTP. Well, you could argue that maybe something like that can happen ONCE. But it already caused a serious loss of trust for us. Fortunately, we haven’t had any further breaches related to this plugin since then, but that’s only because we’ve been extremely cautious about updating it. However, over the past two years, the plugin has had FIVE high-severity and TWO critical vulnerabilities. That’s simply unacceptable for serious projects. After the latest “Unauthenticated Stored Cross-Site Scripting” issue, I’m done with this plugin for good, and we’re switching to WP Mail SMTP everywhere. I’ve already subscribed. I’d rather pay for a reliable and secure plugin than use a free one that keeps leaving the door wide open to attackers once or twice every year. After the last critical issue, I even opened a support request in November, where support claimed that “security remains an absolute top priority.” And now here we are again, 6 months later, with another “unauthenticated” vulnerability – even if it’s “just” XSS this time, and depends on stack and setup. That’s enough for me. It feels like nothing has really changed. This is not a serious plugin, and it should NOT be used for serious projects. I’ve never left a one-star rating before, but this time I had to. Just take a look at the vulnerabilities of Post SMTP on Wordfence Vulnerability Database, their severity, and how often they occur. And compare it with something else, like WP Mail SMTP. We’re moving on and not looking back. Goodbye Post SMTP, hello paid WP Mail SMTP.If you still decide to stick with this plugin, only use it with auto-updates enabled.
No disclosure of extra cost for 365
Dishonest about the cost of product. It’s free unless you have 365. Then it cost a yearly amount. They’re just fleecing people who they think will pay anyway.
Steals your email address without asking, violates GDPR
As soon as activating the plug-in, it will scrape your email address from your Wordpress installation user profile and start sending you emails & periodic newsletter spam without explicit permission. There is no “enter email address” field, no “subscribe” button, no “verify email address” button… it just automatically starts sending emails. Even if you don’t click the link in the verification email, other emails start arriving. If there was an explicit opt-in for that kind of thing it would be fine, but automatically doing it violates GDPR laws.
Great SMTP Plugin
This plugin is great for ensuring your emails get sent via SMTP. It includes a vast number of options and works seamlessly. Excellent job!
Good Plugin
Post SMTP is one of the best SMTP plugins in WordPress. It is reliable and it can connect with multiple email providers.
Highly recommended
We are using this Post SMTP plugin for many years & its reliable to use with massive 3rd party integration.
Great SMTP Plugin
This plugin is great for ensuring your emails get sent via SMTP. It includes a vast number of options and works seamlessly. Excellent job!
Good Plugin
Post SMTP is one of the best SMTP plugins in WordPress. It is reliable and it can connect with multiple email providers.
Highly recommended
We are using this Post SMTP plugin for many years & its reliable to use with massive 3rd party integration.
Simply the best
I install this plugin on every website as it's the only one with logs and fallback server. So I can have SendinBlue without their plugin (don't use newsletters, only transactional emails) and in case it can't be used for delivery, my own SMTP server is used. It works great. Only issue I have is problem with sending emails to non-existing addresses as this prevents sending email completely (would be nice to have the email delivered to website admin at least, even if Reply-To is wrong)2026/08 UPDATE: I can keep recommending this plugin, today we had a headache fixing all the websites with broken credentials and no emails sent for hours (because some people sleep). This is not the first issue with the plugin and it became bulky as well. Simple SMTP + email log can be found in lighter plugins too. Even after updating from bugged beta to 4.0.1 the emails won't be delivered, because the settings in database were broken and the password is not working, needs to be set again.
After the update, there was an error prompting me to rebuild the database; nothi
After the update, there was an error prompting me to rebuild the database; nothing could be done, so I had to roll back.
kris006
August 24, 2026
|
1 reply
Bloat
20mb zipped file while others just are a fraction of this. Stay away from poorly coded plugins.
