CVE-2026-48838: Post SMTP Unauthenticated Stored XSS (CVSS 7.2)

CVE-2026-48838 is a CVSS 7.2 High Unauthenticated Stored XSS in Post SMTP <= 3.6.2. An attacker injects a script via any email-triggering form; it fires when an admin views the email log.