Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ gregersen1

   1mo ago

   The built-in email log has saved me multiple times when troubleshooting delivery issues. Much better visibility than what I had before switching from another SMTP plugin.

   Read on wp.org ↗
2. ★★★★★ aliciaweston

   3mo ago

   I’m a bit of a beginner, and I have to update my PHP. The PHP checker told me that this wasn’t compatible with the latest version of PHP, which I thought was a bit odd because it had been updated only five days before; it didn’t seem like an abandoned plugin. I wrote to them, and they’ve been really helpful and said it’s fully compatible with all the latest versions of PHP. Very nice people, thank you very much for the support.

   Read on wp.org ↗
3. ★★★★★ decupe

   3mo ago

   It’s a fantastic plugin. I’ve replaced it on all my websites. The customer support is fast and very helpful, excellent service! I highly recommend it!

   Read on wp.org ↗
4. ★★★★★ franktastic300

   3mo ago

   20mb zipped file while others just are a fraction of this. Stay away from poorly coded plugins. This topic was modified 1 month, 3 weeks ago by franktastic300.

   Read on wp.org ↗
5. ★★★★★ jkejke

   3mo ago

   Dishonest about the cost of product. It’s free unless you have 365. Then it cost a yearly amount. They’re just fleecing people who they think will pay anyway.

   Read on wp.org ↗
6. ★★★★★ adamzea

   5mo ago

   As soon as activating the plug-in, it will scrape your email address from your WordPress installation user profile and start sending you emails & periodic newsletter spam without explicit permission. There is no “enter email address” field, no “subscribe” button, no “verify email address” button… it just automatically starts sending emails. Even if you don’t click the link in the verification email, other emails start arriving. If there was an explicit opt-in for that kind of thing it would be fine, but automatically doing it violates GDPR laws. This topic was modified 3 months, 2 weeks ago by adamzea.

   Read on wp.org ↗
7. ★★★★★ jcalmeida

   6mo ago

   Great Plugin easy to config and troubleshoot.

   Read on wp.org ↗
8. ★★★★★ AdamJB13

   6mo ago

   Aqib was very helpful in setting up PostSMTP on my site. The plug-in is working very well.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 3.9.5 TWEAK – Updated dashboard banners and removed the Extensions screen from the plugin menu. 3.9.5
2. — Version 3.9.4 FIX – Resolved failed builds reported by Plugintests.com FIX – Addressed PHP deprecation notices related to using null as an array offset FIX – Fixed compatibility issues with the Google Site Kit plugin FIX – Resolved El 3.9.4
3. — Version 3.9.3 TWEAK – Rolled back to version 3.9.1 due to socket-related errors. 3.9.3
4. — Version 3.9.2 TWEAK – Added WordPress 7.0 compatibility. FIX – Addressed PHP deprecation notices related to using null as an array offset. FIX – Fixed compatibility issues with the Google Site Kit plugin. 3.9.2
5. — Version 3.9.1 TWEAK – Updated Emailit API to v2. FIX – Added Header support in Maileroo. FIX – Resolved qrstr class conflict. FIX – Emailit API status handling (status code 201 was incorrectly marked as failed instead of pending/succe 3.9.1
6. — Version 3.9.0 TWEAK – Updated the Setup Wizard UI for Mailers and improved related content. FIX – Resolved REST error: rest_cookie_invalid_nonce (Cookie check failed – 403). FIX – Added support for the pre_wp_mail function for custom 3.9.0

26 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.2 Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-05-28 CVE-2026-48838 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.6.2 Patched in 3.6.3
2. Medium · 6.1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter ↗
   2026-04-30 CVE-2024-13362 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.0.0 Patched in 3.1.0
3. Medium · 5.3 Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite ↗
   2026-03-17 CVE-2026-2559 Missing Authorization Affects <= 3.8.0 Patched in 3.9.0
4. High · 7.2 Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type' ↗
   2026-03-17 CVE-2026-3090 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.0 Patched in 3.9.0
5. Medium · 5.4 Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update ↗
   2025-12-03 CVE-2025-12887 Missing Authorization Affects <= 3.6.1 Patched in 3.6.2
6. Critical · 9.8 Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure ↗
   2025-10-31 CVE-2025-11833 Missing Authorization Affects <= 3.6.0 Patched in 3.6.1
7. Medium · 4.3 Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update ↗
   2025-09-02 CVE-2025-9219 Missing Authorization Affects <= 3.4.1 Patched in 3.4.2
8. High · 8.8 Post SMTP <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via Email Log Exposure ↗
   2025-07-21 CVE-2025-24000 Missing Authorization Affects <= 3.2.0 Patched in 3.3.0
9. Medium · 4.9 Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter ↗
   2025-03-07 CVE-2024-13844 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.1.2 Patched in 3.1.3
10. High · 7.2 Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting ↗
    2025-02-17 CVE-2025-0521 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.0.2 Patched in 3.1.0
11. Medium · 4.3 Post SMTP <= 2.9.11 - Missing Authorization via regenerate_qrcode() ↗
    2025-01-07 CVE-2025-22800 Missing Authorization Affects <= 2.9.11 Patched in 2.9.12
12. Medium · 4.9 Post SMTP <= 2.9.9 - Authenticated (Administrator+) SQL Injection ↗
    2024-11-15 CVE-2024-52436 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.9.9 Patched in 2.9.10
13. High · 7.2 POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection ↗
    2024-05-22 CVE-2024-5207 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.9.3 Patched in 2.9.4
14. Critical · 9.8 POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API ↗
    2024-01-10 CVE-2023-6875 Authorization Bypass Through User-Controlled Key Affects <= 2.8.7 Patched in 2.8.8
15. Medium · 6.1 POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg ↗
    2024-01-02 CVE-2023-6629 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.6 Patched in 2.8.7
16. High · 7.2 POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device ↗
    2024-01-02 CVE-2023-7027 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.7 Patched in 2.8.8
17. High · 7.2 POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.6 - Authenticated (Administrator+) SQL Injection ↗
    2023-12-21 CVE-2023-6620 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.8.6 Patched in 2.8.7
18. High · 7.2 POST SMTP Mailer <= 2.7.0 - Unauthenticated Stored Cross-Site Scripting ↗
    2023-11-06 CVE-2023-5958 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.7.0 Patched in 2.7.1
19. High · 7.2 Post SMTP <= 2.6.0 - Authenticated (Administrator+) SQL Injection ↗
    2023-10-03 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 2.6.1 Patched in 2.6.1
20. Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 2.1.2-beta.1 - 2.5.7 Patched in 2.5.9-beta.1
21. High · 7.2 Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email ↗
    2023-07-11 CVE-2023-3082 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.5.7 Patched in 2.5.8
22. Medium · 6.5 POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Account Compromise ↗
    2023-06-26 CVE-2023-3179 Cross-Site Request Forgery (CSRF) Affects <= 2.5.6 Patched in 2.5.7
23. Medium · 4.3 POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Arbitrary Log Deletion ↗
    2023-06-26 CVE-2023-3178 Cross-Site Request Forgery (CSRF) Affects <= 2.5.6 Patched in 2.5.7
24. Medium · 6.6 Post SMTP <= 2.1.6 - Authenticated (Administrator+) Blind Server-Side Request Forgery ↗
    2022-09-05 CVE-2022-2352 Server-Side Request Forgery (SSRF) Affects <= 2.1.6 Patched in 2.1.7
25. Medium · 5.5 Post SMTP Mailer/Email Log <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2022-08-18 CVE-2022-2351 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.1.3 Patched in 2.1.4
26. Medium · 4.3 POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass ↗
    2021-03-01 CVE-2021-4422 Cross-Site Request Forgery (CSRF) Affects <= 2.0.20 Patched in 2.0.21

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 38 languages, 3 at 90% or more

Plus 14 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-04-25 400K+ → 300K+ down after 4 days in tier
2. 2026-04-21 300K+ → 400K+ up after 1 days in tier
3. 2026-04-20 400K+ → 300K+ down after 1 days in tier
4. 2026-04-19 300K+ → 400K+ up after 2 days in tier
5. 2026-04-17 400K+ → 300K+ down after 2 days in tier
6. 2026-04-15 300K+ → 400K+ up after 1 days in tier
7. 2026-04-14 400K+ → 300K+ down after 32 days in tier
8. 2026-03-13 300K+ → 400K+ up after 4 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers 200K+ installs · 4.5★ · 4 shared tags B
• Bit SMTP – Easy SMTP Solution with Email Logs 2K+ installs · 3.9★ · 4 shared tags B
• WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin 4M+ installs · 4.8★ · 3 shared tags A
• Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more 500K+ installs · 4.6★ · 3 shared tags A
• GoSMTP – SMTP for WordPress 500K+ installs · 4.1★ · 2 shared tags B
• WP Mail Logging 300K+ installs · 4.7★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App into a readme, a review or a deck. It updates itself.

Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: 300K+ active installs, 4.7★ (524 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/post-smtp