Smaily for WP

Smaily for WP has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, one record each. Smaily for WP is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.10.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all Smaily for WP vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2025-47684

Smaily for WP <= 3.1.6 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

2 records


2025-05-07 00:00	Smaily for WP <= 3.1.6 - Cross-Site Request Forgery Smaily for WP <= 3.1.6	`CVE-2025-47684`	4.3 Medium	Nguyen Xuan Chien	No
2024-12-11 00:00	Smaily for WP <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting Smaily for WP <= 3.1.5	`CVE-2024-54286`	6.4 Medium	SOPROBRO	Yes

Showing 1–2 of 2 reports

Latestv3.1.7

Smaily for WP

Author

Smaily

0.0(0)

0/100

Last Updated

2025-08-08 (1y ago)

Active Installs

600+

Downloads

45,326

Requires WP

4.0+

Requires PHP

5.6+

Tested up to

WP 6.4.10

Created

2020-04-01 (7y ago)

Smaily email marketing and automation extension plugin for WordPress. Automatically generate a simple sign-up form and add new subscribers to Smaily subscribers list. Features WordPress Newsletter Subscribers Add new subscribers to Smaily subscribers list. Select autoresponder to send automated emails. Shortcode for adding newsletter form. Subscription Widget Option for custom advanced HTML form. Functional even with NoScript users. Supports sending custom form values to Smaily. Documentation & Support Online documentation with help is available at the Knowledgebase. Contribute All development for Smaily for WordPress is handled via GitHub. Opening new issues and submitting pull requests are welcome. Smaily for WordPress — Deprecation notice Smaily for WordPress is officially deprecated. It is no longer maintained, and no further updates or security patches will be provided. We have released Smaily Connect, a new plugin that combines support for WordPress, WooCommerce, Contact Form 7, and Elementor in a single package. Please migrate now! In your WordPress admin go to Plugins → Installed Plugins. Deactivate and Delete Smaily for WordPress. Go to Plugins → Add New, search for “Smaily Connect”, then Install and Activate. Open Smaily Connect and re-connect your Smaily account (subdomain, API user, API password). For assistance, contact support@smaily.com. Smaily Connect

View on WordPress.org