Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,371 results · page 11 of 48
Jan 20, 2026weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation: Authorization bypassCVE-2025-14348 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's REST API trusting the `x-wemail-user` HTTP header to identify users without verifying the request originates from an authenticated WordPress session. This makes it possible for unauthenticated attackers who know or can guess an admin email (easily enumerable via `/wp-json/wp/v2/users`) to impersonate that user and access the CSV subscriber endpoints, potentially exfiltrating subscriber PII (emails, names, phone numbers) from imported CSV files.
- Product
- weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 19, 2026Newsletter – Send awesome emails from: Cross-Site Request ForgeryCVE-2026-1051 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1.0. This is due to missing or incorrect nonce validation on the hook_newsletter_action() function. This makes it possible for unauthenticated attackers to unsubscribe newsletter subscribers via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.
- Product
- Newsletter – Send awesome emails from
- Affected
- up to 9.1.0
- What to do
- Affects up to 9.1.0. Update Newsletter – Send awesome emails from to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 19, 2026Mailpit is an email testing tool and API for developers.CVE-2026-23845 · Other software · axllent · reported by GitHubMedium 5.8
Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `<link rel="stylesheet" href="...">` tags to inline them for testing. Version 1.28.3 fixes the issue.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2026Mailpit is an email testing tool and API for developers.CVE-2026-23829 · Other software · axllent · reported by GitHubMedium 5.3
Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2026CM E-Mail Blacklist – Simple email filtering for safer registration: Stored Cross-Site ScriptingCVE-2026-0691 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all versions up to, and including, 1.6.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- CM E-Mail Blacklist – Simple email filtering for safer registration
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update CM E-Mail Blacklist – Simple email filtering for safer registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2026LEAV Last Email Address Validator: Cross-Site Request ForgeryCVE-2025-14853 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions <= 1.7.1. This is due to missing or incorrect nonce validation on the display_settings_page function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- LEAV Last Email Address Validator
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update LEAV Last Email Address Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 15, 2026A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthenticatCVE-2025-67823 · Email & office · Mitel · reported by MITREHigh 8.2
A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthenticated attacker to conduct a Cross-Site Scripting (XSS) attack due to insufficient input validation. A successful exploit requires user interaction where the email channel is enabled. This could allow an attacker to execute arbitrary scripts in the victim's browser or desktop client application.
- Product
- CX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML CVE-2021-47768 · Other software · thundernest · reported by VulnCheckMedium 5.3
ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execute during HTML export, potentially compromising user data or session credentials.
- Product
- ImportExportTools NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.thunderbird.netgithub.com
Jan 15, 2026Kalium 3 | Creative WordPress & WooCommerce: Unauthorized email sendingCVE-2025-12895 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf.
- Product
- Kalium 3 | Creative WordPress & WooCommerce
- Affected
- up to 3.29
- What to do
- Affects up to 3.29. Update Kalium 3 | Creative WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocumentation.laborator.cothemeforest.net
Jan 14, 2026AliasVault is a privacy-first password manager with built-in email aliasing.CVE-2026-22694 · Other software · aliasvault · reported by GitHubMedium 6.1
AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.
- Product
- aliasvault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026The vulnerability exists in BLUVOYIX due to design flaws in the email sending API.CVE-2026-22239 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploitation of this vulnerability could allow the attacker to send unsolicited emails to anyone on behalf of the company.
- Product
- BLUVOYIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Mailhog 1.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through email attachments.CVE-2022-50908 · Other software · Mailhog · reported by VulnCheckMedium 5.1
Mailhog 1.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through email attachments. Attackers can send crafted emails with XSS payloads to execute arbitrary API calls, including message deletion and browser manipulation.
- Product
- Mailhog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 13, 2026Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted emCVE-2026-0543 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effectiCVE-2026-0495 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.1
SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.
- Product
- SAP Fiori App (Intercompany Balance Reconciliation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_coCVE-2025-67147 · Other software · reported by MITRECritical 9.8
Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_contact.php, the 'username' and 'pass_key' parameters in (2) secure_login.php, and the 'login_id', 'pwfield', and 'login_key' parameters in (3) change_s_pwd.php. An unauthenticated or authenticated attacker can exploit these issues to bypass authentication, execute arbitrary SQL commands, modify database records, delete data, or escalate privileges to administrator level.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.CVE-2021-41074 · Other software · Webkul · reported by MITREMedium 5.4
A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.
- Product
- Qloapps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2026Mailpit is an email testing tool and API for developers.CVE-2026-22689 · Other software · axllent · reported by GitHubMedium 6.5
Mailpit is an email testing tool and API for developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation introduces a Cross-Site WebSocket Hijacking (CSWSH) vulnerability. An attacker can host a malicious website that, when visited by a developer running Mailpit locally, establishes a WebSocket connection to the victim's Mailpit instance (default ws://localhost:8025). This allows the attacker to intercept sensitive data such as email contents, headers, and server statistics in real-time. This issue has been patched in version 1.28.2.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Mailpit is an email testing tool and API for developers.CVE-2026-21859 · Other software · axllent · reported by GitHubMedium 5.8
Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it does not block internal IP addresses, enabling attackers to access internal services and APIs. This vulnerability is limited to HTTP GET requests with minimal headers. The issue is fixed in version 1.28.1.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Optional Email: Privilege EscalationCVE-2025-15018 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts.
- Product
- Optional Email
- Affected
- up to 1.3.11
- What to do
- Affects up to 1.3.11. Update Optional Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2026Newsletter Email Subscribe: Cross-Site Request ForgeryCVE-2025-14904 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect nonce validation on the nels_settings_page function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Newsletter Email Subscribe
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Newsletter Email Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2026twinklesmtp – Email Service Provider For: Stored Cross-Site ScriptingCVE-2025-14887 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- twinklesmtp – Email Service Provider For
- Affected
- up to 1.03
- What to do
- Affects up to 1.03. Update twinklesmtp – Email Service Provider For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2026QR Code for WooCommerce order emails, PDF invoices, packing slips: Stored Cross-Site ScriptingCVE-2025-14626 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.9.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- QR Code for WooCommerce order emails, PDF invoices, packing slips
- Affected
- up to 1.9.42
- What to do
- Affects up to 1.9.42. Update QR Code for WooCommerce order emails, PDF invoices, packing slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2026EmailKit: Arbitrary File ReadCVE-2025-14059 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the create_template REST API endpoint where user-controlled input from the emailkit-editor-template parameter is passed directly to file_get_contents() without sanitization. This makes it possible for authenticated attackers with Author-level permissions or higher to read arbitrary files on the server, including sensitive configuration files like /etc/passwd and wp-config.php, via the REST API. The file contents are stored in post meta and can be exfiltrated through MetForm's email confirmation feature.
- Product
- EmailKit
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update EmailKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2026Email Customizer for WooCommerce: Stored Cross-Site ScriptingCVE-2025-13974 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in email templates that will execute when customers view transactional emails. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Email Customizer for WooCommerce
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2026The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin forCVE-2025-11370 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'store' function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings.
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Claspo – Popups, Spin the Wheel & Email Capture: Missing AuthorizationCVE-2025-68568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Claspo – Popups, Spin the Wheel & Email Capture: from n/a through <= 1.0.7.
- Product
- Claspo – Popups, Spin the Wheel & Email Capture
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Claspo – Popups, Spin the Wheel & Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Email Capture: Cross-Site Request Forgery (CSRF)CVE-2025-68529 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.
- Product
- WP Email Capture
- Affected
- up to 3.12.5
- What to do
- Affects up to 3.12.5. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2025AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service.CVE-2023-53949 · Other software · Aspemail · reported by VulnCheckHigh 8.5
AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service. Attackers can exploit full write permissions in the BIN directory to replace the service executable and gain elevated system access.
- Product
- AspEmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaspemail.comexploit-db.com
Dec 18, 2025GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses.CVE-2023-53943 · Other software · Glpi-Project · reported by VulnCheckMedium 6.9
GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts.
- Product
- GLPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglpi-project.orgexploit-db.com
Dec 18, 2025An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form fields.CVE-2022-50684 · Other software · Kentico · reported by VulnCheckMedium 5.1
An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form fields. Unencoded form values could enable HTML content execution in recipient email clients, potentially compromising email security.
- Product
- Xperience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevnet.kentico.comvulncheck.com
Dec 18, 2025A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts via email marketing templates.CVE-2022-50680 · Other software · Kentico · reported by VulnCheckMedium 5.1
A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts via email marketing templates. Attackers can exploit this vulnerability to execute malicious scripts that could compromise user browsers and steal sensitive information.
- Product
- Xperience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevnet.kentico.comvulncheck.com
Dec 18, 2025A flaw was found in Nodemailer.CVE-2025-14874 · Other software · nodemailer · reported by Red HatHigh 7.5
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
- Product
- nodemailer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 18, 2025Email marketing for WordPress by GetResponse Official: Missing AuthorizationCVE-2025-64273 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
- Product
- Email marketing for WordPress by GetResponse Official
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Email marketing for WordPress by GetResponse Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Email marketing for WordPress by GetResponse Official: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64272 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Retrieve Embedded Sensitive Data.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
- Product
- Email marketing for WordPress by GetResponse Official
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Email marketing for WordPress by GetResponse Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Download After Email: Missing AuthorizationCVE-2025-54743 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download After Email: from n/a through 2.1.5-2.1.6.
- Product
- Download After Email
- Affected
- up to 2.1.5-2.1.6
- What to do
- Affects up to 2.1.5-2.1.6. Update Download After Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Contact Form Email: Authorization Bypass Through User-Controlled KeyCVE-2025-10019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.60.
- Product
- Contact Form Email
- Affected
- up to 1.3.60
- What to do
- Affects up to 1.3.60. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows CVE-2025-65319 · Other software · Blixhq · reported by MITRECritical 9.1
When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software.
- Product
- Bluemail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Dec 16, 2025SendPulse Email Marketing Newsletter: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67948 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.2.1.
- Product
- SendPulse Email Marketing Newsletter
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update SendPulse Email Marketing Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2025Icegram Express - Email Subscribers, Newsletters and Marketing Automation: Missing AuthorizationCVE-2025-12348 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `run_action_scheduler_task` function. This makes it possible for unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs, potentially triggering email sends, maintenance tasks, or other privileged operations, causing unexpected state changes and resource usage.
- Product
- Icegram Express - Email Subscribers, Newsletters and Marketing Automation
- Affected
- up to 5.9.10
- What to do
- Affects up to 5.9.10. Update Icegram Express - Email Subscribers, Newsletters and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2025Guest Support: User Email DisclosureCVE-2025-13660 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a public AJAX endpoint that allows anyone to search for and retrieve user email addresses without any authentication or capability checks. This makes it possible for unauthenticated attackers to enumerate user accounts and extract email addresses via the guest_support_handler=ajax endpoint with the request=get_users parameter.
- Product
- Guest Support
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Guest Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025Kirim.Email WooCommerce Integration: Cross-Site Request ForgeryCVE-2025-14165 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is due to missing nonce validation on the plugin's settings page. This makes it possible for unauthenticated attackers to modify the plugin's API credentials and integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Kirim.Email WooCommerce Integration
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Kirim.Email WooCommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025Hide Email Address: Stored Cross-Site ScriptingCVE-2025-13884 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Hide Email Address plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inline_css' parameter in the `bg-hide-email-address` shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Hide Email Address
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Hide Email Address to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can iCVE-2025-13052 · Network & remote access · ASUSTOR · reported by security@asustor.comHigh 7
When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can intercept network traffic between the SMTP client and server to execute a man-in-the-middle (MITM) attack, which may obtain the sensitive information of the SMTP. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RKD2 as well as from ADM 5.0.0 through ADM 5.1.0.RN42.
- Product
- ADM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates.CVE-2024-58303 · Other software · Flarum · reported by VulnCheckHigh 8.6
FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.
- Product
- FriendsofFlarum Pretty Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates.CVE-2024-58302 · Other software · Flarum · reported by VulnCheckMedium 6.9
FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to read sensitive system files like /etc/passwd during email generation.
- Product
- FriendsofFlarum Pretty Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interCVE-2025-13211 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
- Product
- Aspera Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025WP Email Capture: Missing AuthorizationCVE-2025-67578 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Email Capture: from n/a through <= 3.12.4.
- Product
- WP Email Capture
- Affected
- up to 3.12.4
- What to do
- Affects up to 3.12.4. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Elastic Email Sender: Missing AuthorizationCVE-2025-66525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Elastic Email Elastic Email Sender elastic-email-sender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Sender: from n/a through <= 1.2.20.
- Product
- Elastic Email Sender
- Affected
- up to 1.2.20
- What to do
- Affects up to 1.2.20. Update Elastic Email Sender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2025Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification: Authentication bypassCVE-2025-12374 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.
- Product
- Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification
- Affected
- up to 2.0.44
- What to do
- Affects up to 2.0.44. Update Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 2, 2025SureMail – SMTP and Email Logs: Unrestricted Upload of File with Dangerous TypeCVE-2025-13516 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's save_file() function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessible directory (wp-content/uploads/suremails/attachments/) without validating file extensions or content types. Files are saved with predictable names derived from MD5 hashes of their content. While the plugin attempts to protect this directory with an Apache .htaccess file to disable PHP execution, this protection is ineffective on nginx, IIS, and Lighttpd servers, or on misconfigured Apache installations. This makes it possible for unauthenticated attackers to achieve Remote Code Execution by uploading malicious PHP files through any public form that emails attachments, calculating the predictable filename, and directly accessing the file to execute arbitrary code granted they are exploiting a site running on an affected web server configuration.
- Product
- SureMail – SMTP and Email Logs
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update SureMail – SMTP and Email Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcwe.mitre.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.