Postie <= 1.9.40 - Post Submission Spoofing & Stored XSS

“The Postie plugin for WordPress only allows posting of articles submitted by authorized users through a mailing list registered in the plugin settings. However through the email sender’s spoofing technique, it was possible to bypass the plugin settings and publish a post as having been sent by a valid user.” This could be used to create a post with an XSS payload.