Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · ultimate-wp-mail
Ultimate WP Mail
6 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 22, 2025Ultimate WP Mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53454 · affects up to 1.3.8 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Stored XSS.This issue affects Ultimate WP Mail: from n/a through <= 1.3.8.
Jul 16, 2025Ultimate WP Mail: Privilege EscalationCVE-2025-6993 · affects 1.0.17 to 1.3.6 · reported by WordfenceHigh 7.5
The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the get_email_log_details() AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied post_id and retrieves the corresponding email log post content (including the password-reset link), relying only on the ‘edit_posts’ capability without restricting to administrators or validating ownership. This makes it possible for authenticated attackers, with Contributor-level access and above, to harvest an admin’s reset link and elevate their privileges to administrator.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2025Ultimate WP Mail: Missing AuthorizationCVE-2025-49288 · affects up to 1.3.5 · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through <= 1.3.5.
May 7, 2025Ultimate WP Mail: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47490 · affects up to 1.3.4 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows SQL Injection.This issue affects Ultimate WP Mail: from n/a through <= 1.3.4.
May 7, 2025Ultimate WP Mail: Cross-Site Request Forgery (CSRF)CVE-2025-47466 · affects up to 1.3.4 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Cross Site Request Forgery.This issue affects Ultimate WP Mail: from n/a through <= 1.3.4.
Apr 9, 2025Ultimate WP Mail: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-32694 · affects up to 1.3.10 · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Phishing.This issue affects Ultimate WP Mail: from n/a through <= 1.3.10.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.