Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

1714 searches this plugin appeared in over the last 90 days, 20 listed. 1521 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 6 months ago; a band this size takes about a year or more to cross, which places it about 50% of the way through.

1. ★★★★★ gregersen1

   4mo ago

   The built-in email log has saved me multiple times when troubleshooting delivery issues. Much better visibility than what I had before switching from another SMTP plugin.

   Read on wp.org ↗
2. ★★★★★ aliciaweston

   5mo ago

   I’m a bit of a beginner, and I have to update my PHP. The PHP checker told me that this wasn’t compatible with the latest version of PHP, which I thought was a bit odd because it had been updated only five days before; it didn’t seem like an abandoned plugin. I wrote to them, and they’ve been really helpful and said it’s fully compatible with all the latest versions of PHP. Very nice people, thank you very much for the support.

   Read on wp.org ↗
3. ★★★★★ decupe

   5mo ago

   It’s a fantastic plugin. I’ve replaced it on all my websites. The customer support is fast and very helpful, excellent service! I highly recommend it!

   Read on wp.org ↗
4. ★★★★★ franktastic300

   5mo ago

   20mb zipped file while others just are a fraction of this. Stay away from poorly coded plugins. This topic was modified 1 month, 3 weeks ago by franktastic300.

   Read on wp.org ↗
5. ★★★★★ jkejke

   6mo ago

   Dishonest about the cost of product. It’s free unless you have 365. Then it cost a yearly amount. They’re just fleecing people who they think will pay anyway.

   Read on wp.org ↗
6. ★★★★★ adamzea

   7mo ago

   As soon as activating the plug-in, it will scrape your email address from your WordPress installation user profile and start sending you emails & periodic newsletter spam without explicit permission. There is no “enter email address” field, no “subscribe” button, no “verify email address” button… it just automatically starts sending emails. Even if you don’t click the link in the verification email, other emails start arriving. If there was an explicit opt-in for that kind of thing it would be fine, but automatically doing it violates GDPR laws. This topic was modified 3 months, 2 weeks ago by adamzea.

   Read on wp.org ↗
7. ★★★★★ jcalmeida

   8mo ago

   Great Plugin easy to config and troubleshoot.

   Read on wp.org ↗
8. ★★★★★ AdamJB13

   8mo ago

   Aqib was very helpful in setting up PostSMTP on my site. The plug-in is working very well.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 3.9.5 TWEAK – Updated dashboard banners and removed the Extensions screen from the plugin menu. 3.9.5
2. — Version 3.9.4 FIX – Resolved failed builds reported by Plugintests.com FIX – Addressed PHP deprecation notices related to using null as an array offset FIX – Fixed compatibility issues with the Google Site Kit plugin FIX – Resolved El 3.9.4
3. — Version 3.9.3 TWEAK – Rolled back to version 3.9.1 due to socket-related errors. 3.9.3
4. — Version 3.9.2 TWEAK – Added WordPress 7.0 compatibility. FIX – Addressed PHP deprecation notices related to using null as an array offset. FIX – Fixed compatibility issues with the Google Site Kit plugin. 3.9.2
5. — Version 3.9.1 TWEAK – Updated Emailit API to v2. FIX – Added Header support in Maileroo. FIX – Resolved qrstr class conflict. FIX – Emailit API status handling (status code 201 was incorrectly marked as failed instead of pending/succe 3.9.1
6. — Version 3.9.0 TWEAK – Updated the Setup Wizard UI for Mailers and improved related content. FIX – Resolved REST error: rest_cookie_invalid_nonce (Cookie check failed – 403). FIX – Added support for the pre_wp_mail function for custom 3.9.0

All 28 disclosed vulnerabilities are patched in the current version (4.0.2). Sites still on an older version should update.

1. Patched High · 7.2 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log) ↗
   2026-10-05 CVE-2026-75962 Improper Neutralization of Input During Web Page Generation Affects <= 4.0.1 Patched in 4.0.2
2. Patched Medium · 6.3 Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 4.0.0-beta.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change ↗
   2026-08-26 CVE-2026-81278 Missing Authorization Affects 4.0.0-beta.1 Patched in 4.0.1
3. Patched High · 7.2 Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-05-28 CVE-2026-48838 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.2 Patched in 3.6.3
4. Patched Medium · 6.1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter ↗
   2026-04-30 CVE-2024-13362 Improper Neutralization of Input During Web Page Generation Affects <= 3.0.0 Patched in 3.1.0
5. Patched Medium · 5.3 Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite ↗
   2026-03-17 CVE-2026-2559 Missing Authorization Affects <= 3.8.0 Patched in 3.9.0
6. Patched High · 7.2 Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type' ↗
   2026-03-17 CVE-2026-3090 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.0 Patched in 3.9.0
7. Patched Medium · 5.4 Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update ↗
   2025-12-03 CVE-2025-12887 Missing Authorization Affects <= 3.6.1 Patched in 3.6.2
8. Patched Critical · 9.8 Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure ↗
   2025-10-31 CVE-2025-11833 Missing Authorization Affects <= 3.6.0 Patched in 3.6.1
9. Patched Medium · 4.3 Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update ↗
   2025-09-02 CVE-2025-9219 Missing Authorization Affects <= 3.4.1 Patched in 3.4.2
10. Patched High · 8.8 Post SMTP <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via Email Log Exposure ↗
    2025-07-21 CVE-2025-24000 Missing Authorization Affects <= 3.2.0 Patched in 3.3.0
11. Patched Medium · 4.9 Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter ↗
    2025-03-07 CVE-2024-13844 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.1.2 Patched in 3.1.3
12. Patched High · 7.2 Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting ↗
    2025-02-17 CVE-2025-0521 Improper Neutralization of Input During Web Page Generation Affects <= 3.0.2 Patched in 3.1.0
13. Patched Medium · 4.3 Post SMTP <= 2.9.11 - Missing Authorization via regenerate_qrcode() ↗
    2025-01-07 CVE-2025-22800 Missing Authorization Affects <= 2.9.11 Patched in 2.9.12
14. Patched Medium · 4.9 Post SMTP <= 2.9.9 - Authenticated (Administrator+) SQL Injection ↗
    2024-11-15 CVE-2024-52436 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.9.9 Patched in 2.9.10
15. Patched High · 7.2 POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection ↗
    2024-05-22 CVE-2024-5207 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.9.3 Patched in 2.9.4
16. Patched Critical · 9.8 POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API ↗
    2024-01-10 CVE-2023-6875 Authorization Bypass Through User-Controlled Key Affects <= 2.8.7 Patched in 2.8.8
17. Patched Medium · 6.1 POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg ↗
    2024-01-02 CVE-2023-6629 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.6 Patched in 2.8.7
18. Patched High · 7.2 POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device ↗
    2024-01-02 CVE-2023-7027 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.7 Patched in 2.8.8
19. Patched High · 7.2 POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.6 - Authenticated (Administrator+) SQL Injection ↗
    2023-12-21 CVE-2023-6620 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.8.6 Patched in 2.8.7
20. Patched High · 7.2 POST SMTP Mailer <= 2.7.0 - Unauthenticated Stored Cross-Site Scripting ↗
    2023-11-06 CVE-2023-5958 Improper Neutralization of Input During Web Page Generation Affects <= 2.7.0 Patched in 2.7.1
21. Patched High · 7.2 Post SMTP <= 2.6.0 - Authenticated (Administrator+) SQL Injection ↗
    2023-10-03 Improper Neutralization of Special Elements used in an SQL Command Affects < 2.6.1 Patched in 2.6.1
22. Patched Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation Affects 2.1.2-beta.1 - 2.5.7 Patched in 2.5.9-beta.1
23. Patched High · 7.2 Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email ↗
    2023-07-11 CVE-2023-3082 Improper Neutralization of Input During Web Page Generation Affects <= 2.5.7 Patched in 2.5.8
24. Patched Medium · 6.5 POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Account Compromise ↗
    2023-06-26 CVE-2023-3179 Cross-Site Request Forgery Affects <= 2.5.6 Patched in 2.5.7
25. Patched Medium · 4.3 POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Arbitrary Log Deletion ↗
    2023-06-26 CVE-2023-3178 Cross-Site Request Forgery Affects <= 2.5.6 Patched in 2.5.7
26. Patched Medium · 6.6 Post SMTP <= 2.1.6 - Authenticated (Administrator+) Blind Server-Side Request Forgery ↗
    2022-09-05 CVE-2022-2352 Server-Side Request Forgery Affects <= 2.1.6 Patched in 2.1.7
27. Patched Medium · 5.5 Post SMTP Mailer/Email Log <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2022-08-18 CVE-2022-2351 Improper Neutralization of Input During Web Page Generation Affects <= 2.1.3 Patched in 2.1.4
28. Patched Medium · 4.3 POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass ↗
    2021-03-01 CVE-2021-4422 Cross-Site Request Forgery Affects <= 2.0.20 Patched in 2.0.21

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 41 languages, 6 at 90% or more

Plus 17 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-04-25 400K+ → 300K+ down after 4 days in tier
2. 2026-04-21 300K+ → 400K+ up after 1 days in tier
3. 2026-04-20 400K+ → 300K+ down after 1 days in tier
4. 2026-04-19 300K+ → 400K+ up after 2 days in tier
5. 2026-04-17 400K+ → 300K+ down after 2 days in tier
6. 2026-04-15 300K+ → 400K+ up after 1 days in tier
7. 2026-04-14 400K+ → 300K+ down after 32 days in tier
8. 2026-03-13 300K+ → 400K+ up after 4 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App into a readme, a review or a deck. It updates itself.

Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: 300K+ active installs, 4.7★ (528 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/post-smtp