SMTP2GO for WordPress – Email Made Easy Security & Risk Analysis

The smtp2go plugin version 1.14.1 presents a mixed security posture. While the static analysis indicates a very small attack surface with no identified unprotected entry points, the code signals reveal significant concerns regarding database interaction and output handling. All seven SQL queries are executed without prepared statements, posing a substantial risk of SQL injection vulnerabilities, especially given the plugin's history of medium-severity vulnerabilities related to improper authorization and cross-site scripting. The low percentage of properly escaped output (27%) further exacerbates this risk, increasing the likelihood of cross-site scripting attacks if malicious input is not neutralized before rendering. Although there are currently no unpatched vulnerabilities, the plugin's past issues and the identified code-level weaknesses suggest a need for thorough auditing and remediation.