Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

867 results · page 5 of 18

Mar 13, 2026MailerPress: Server-Side Request Forgery (SSRF)CVE-2026-32353 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in MailerPress Team MailerPress mailerpress allows Server Side Request Forgery.This issue affects MailerPress: from n/a through <= 1.4.2.
Product
MailerPress
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update MailerPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifCVE-2026-22216 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into theCVE-2026-22204 · WordPress plugins & themes · reported by VulnCheckMedium 6.3
wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafCVE-2026-22202 · WordPress plugins & themes · reported by VulnCheckMedium 6.1
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploitingCVE-2026-22182 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 11, 2026LearnPress – WordPress LMS: Unauthorized email notification triggeringCVE-2026-3226 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check before dispatching to handler functions. The wp_rest nonce is embedded in the frontend JavaScript for all authenticated users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger arbitrary email notifications to admins, instructors, and users, enabling email flooding, social engineering, and impersonation of admin decisions regarding instructor requests.
Product
LearnPress – WordPress LMS
Affected
up to 4.3.2.8
What to do
Affects up to 4.3.2.8. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 10, 2026MC4WP: Mailchimp for: Missing AuthorizationCVE-2026-1781 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source).
Product
MC4WP: Mailchimp for
Affected
up to 4.11.1
What to do
Affects up to 4.11.1. Update MC4WP: Mailchimp for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cwe.mitre.org github.com
Mar 6, 2026MailArchiver: Stored Cross-Site ScriptingCVE-2026-2721 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
MailArchiver
Affected
up to 4.4.0
What to do
Affects up to 4.4.0. Update MailArchiver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 4, 2026Mail Mint: Does not have authorization in one of its REST API endpointCVE-2026-2025 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog
Product
Mail Mint
Fixed in
1.19.5
What to do
Update Mail Mint to 1.19.5 or newer.
Full record and what to do →NVD record wpscan.com
Mar 3, 2026Email Subscribers by Icegram Express: SQL InjectionCVE-2026-1651 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the 'workflow_ids' parameter in all versions up to, and including, 5.9.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Email Subscribers by Icegram Express
Affected
up to 5.9.16
What to do
Affects up to 5.9.16. Update Email Subscribers by Icegram Express to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org gist.github.com
Feb 28, 2026WP Mail Logging: PHP Object InjectionCVE-2026-2471 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor calling `maybe_unserialize()` on all properties retrieved from the database without validation. This makes it possible for unauthenticated attackers to inject a PHP Object by submitting a double-serialized payload through any public-facing form that sends email (e.g., Contact Form 7). When the email is logged and subsequently viewed by an administrator, the malicious payload is deserialized into an arbitrary PHP object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
WP Mail Logging
Affected
up to 1.15.0
What to do
Affects up to 1.15.0. Update WP Mail Logging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2026MailArchiver: SQL InjectionCVE-2026-2831 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MailArchiver
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update MailArchiver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 21, 2026weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation: Unauthorized form deletionCVE-2025-14339 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the `Forms::permission()` callback only validating the `X-WP-Nonce` header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the `weMail` JavaScript object on pages with weMail forms, any unauthenticated user can permanently delete all weMail forms by extracting the nonce from the page source and sending a DELETE request to the forms endpoint.
Product
weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2026Zoho ZeptoMail: Missing AuthorizationCVE-2025-67972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zoho ZeptoMail: from n/a through 3.2.9.
Product
Zoho ZeptoMail
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Zoho ZeptoMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026YayMail: Missing AuthorizationCVE-2026-27327 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail: from n/a through <= 4.3.2.
Product
YayMail
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update YayMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026MailerLite: Missing AuthorizationCVE-2026-25420 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.
Product
MailerLite
Affected
up to 1.7.18
What to do
Affects up to 1.7.18. Update MailerLite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Mail Mint: Missing AuthorizationCVE-2026-23541 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mint: from n/a through <= 1.19.4.
Product
Mail Mint
Affected
up to 1.19.4
What to do
Affects up to 1.19.4. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026PostmarkApp Email Integrator: Stored Cross-Site ScriptingCVE-2026-1043 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The PostmarkApp Email Integrator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 2.4. This is due to insufficient input sanitization and output escaping on the pma_api_key and pma_sender_address parameters. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the settings page.
Product
PostmarkApp Email Integrator
Affected
up to 2.4
What to do
Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Two Factor (2FA) Authentication via Email: Two-Factor Authentication BypassCVE-2025-13587 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one.
Product
Two Factor (2FA) Authentication via Email
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Two Factor (2FA) Authentication via Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Mailchimp List Subscribe Form: Cross-Site Request ForgeryCVE-2025-12172 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mailchimp List Subscribe Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to missing or incorrect nonce validation on the mailchimp_sf_change_list_if_necessary() function. This makes it possible for unauthenticated attackers to change Mailchimp lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Mailchimp List Subscribe Form
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Mailchimp List Subscribe Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2026Brevo - Email, SMS, Web Push, Chat, and more.: Authorization bypassCVE-2025-14799 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Brevo - Email, SMS, Web Push, Chat, and more. plugin for WordPress is vulnerable to authorization bypass due to type juggling in all versions up to, and including, 3.3.0. This is due to the use of loose comparison (==) instead of strict comparison (===) when validating the installation ID in the `/wp-json/mailin/v1/mailin_disconnect` REST API endpoint. This makes it possible for unauthenticated attackers to disconnect the Brevo integration, delete the API key, remove all subscription forms, and reset plugin settings by sending a boolean `true` value for the `id` parameter, which bypasses the authorization check through PHP type juggling.
Product
Brevo - Email, SMS, Web Push, Chat, and more.
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Brevo - Email, SMS, Web Push, Chat, and more. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026YayMail – WooCommerce Email Customizer: Stored Cross-Site ScriptingCVE-2026-1943 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
YayMail – WooCommerce Email Customizer
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update YayMail – WooCommerce Email Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026YayMail – WooCommerce Email Customizer: Unauthorized license key deletionCVE-2026-1938 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the `/yaymail-license/v1/license/delete` REST endpoint in versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to delete the plugin's license key via the '/yaymail-license/v1/license/delete' endpoint granted they can obtain the REST API nonce.
Product
YayMail – WooCommerce Email Customizer
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update YayMail – WooCommerce Email Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026YayMail - WooCommerce Email Customizer: Unauthorized plugin installation and activationCVE-2026-1831 · WordPress plugins & themes · reported by WordfenceLow 2.7
The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability checks on the 'yaymail_install_yaysmtp' AJAX action and `/yaymail/v1/addons/activate` REST endpoint in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to install and activate the YaySMTP plugin.
Product
YayMail - WooCommerce Email Customizer
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update YayMail - WooCommerce Email Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026YayMail – WooCommerce Email Customizer: Unauthorized modification of data that can lead to privilege escalationCVE-2026-1937 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the `yaymail_import_state` AJAX action in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
YayMail – WooCommerce Email Customizer
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update YayMail – WooCommerce Email Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026EmailKit – Email Customizer for WooCommerce & WP: Unauthorized data modificationCVE-2026-1925 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'update_template_data' function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the title of any post on the site, including posts, pages, and custom post types.
Product
EmailKit – Email Customizer for WooCommerce & WP
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update EmailKit – Email Customizer for WooCommerce & WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution: Email Relay AbuseCVE-2026-1714 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient with full control over the subject line, message content, and sender address (via CRLF injection in the 'wlemail' parameter), effectively turning the website into a full email relay for spam or phishing campaigns.
Product
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 17, 2026Frontend File Manager: Allows unauthenticated users to send emails through the site without any security checksCVE-2026-0829 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attackers can also guess file IDs to access and share uploaded files without permission, exposing sensitive information.
Product
Frontend File Manager
Affected
up to 23.5
What to do
Affects up to 23.5. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 14, 2026Mail Mint: Blind SQL InjectionCVE-2026-1258 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map' API endpoints in all versions up to, and including, 1.19.2 . This is due to insufficient escaping on the user supplied 'order-by', 'order-type', and 'selectedCourses' parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for authenticated attackers, with administrator level access and above, to append additional SQL queries into already existing queries.
Product
Mail Mint
Affected
up to 1.19.2
What to do
Affects up to 1.19.2. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026MailChimp Campaigns: Missing AuthorizationCVE-2026-1303 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MailChimp Campaigns plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.2.4. This is due to missing capability checks on the `mailchimp_campaigns_manager_disconnect_app` function that is hooked to the AJAX action of the same name. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the site from its MailChimp synchronization app, disrupting automated email campaigns and marketing integrations.
Product
MailChimp Campaigns
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update MailChimp Campaigns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026Magic Login Mail or QR Code: Privilege EscalationCVE-2026-2144 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. The file is only deleted after wp_mail() completes, creating an exploitable race condition window. This makes it possible for unauthenticated attackers to trigger a login link request for any user, including administrators, and then exploit the race condition between QR code file creation and deletion to obtain the login URL encoded in the QR code, thereby gaining unauthorized access to the targeted user's account.
Product
Magic Login Mail or QR Code
Affected
up to 2.05
What to do
Affects up to 2.05. Update Magic Login Mail or QR Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026Easy Voice Mail: Stored Cross-Site ScriptingCVE-2026-1164 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Voice Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Voice Mail
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Easy Voice Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 3, 2026Mail Mint: Cross-Site Request ForgeryCVE-2026-1447 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Mail Mint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19.2. This is due to missing nonce validation on the create_or_update_note function. This makes it possible for unauthenticated attackers to create or update contact notes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to missing sanitization and escaping this can lead to stored Cross-Site Scripting.
Product
Mail Mint
Affected
up to 1.19.2
What to do
Affects up to 1.19.2. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2026Hustle – Email Marketing, Lead Generation, Optins, Popups: Arbitrary file uploadsCVE-2026-0911 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action_import_module() function in all versions up to, and including, 7.8.9.2. This makes it possible for authenticated attackers, with a lower-privileged role (e.g., Subscriber-level access and above), to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires an admin to grant Hustle module permissions (or module edit access) to the low-privileged user so they can access the Hustle admin page and obtain the required nonce.
Product
Hustle – Email Marketing, Lead Generation, Optins, Popups
Affected
up to 7.8.9.2
What to do
Affects up to 7.8.9.2. Update Hustle – Email Marketing, Lead Generation, Optins, Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 23, 2026Download After Email: Missing AuthorizationCVE-2026-24541 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download After Email: from n/a through <= 2.1.9.
Product
Download After Email
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Download After Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Email Inquiry & Cart Options for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24526 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Truman Email Inquiry & Cart Options for WooCommerce woocommerce-email-inquiry-cart-options allows DOM-Based XSS.This issue affects Email Inquiry & Cart Options for WooCommerce: from n/a through <= 3.5.0.
Product
Email Inquiry & Cart Options for WooCommerce
Affected
up to 3.5.0
What to do
Affects up to 3.5.0. Update Email Inquiry & Cart Options for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026WP Test Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69102 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boopathi Rajan WP Test Email wp-test-email allows Reflected XSS.This issue affects WP Test Email: from n/a through <= 1.1.7.
Product
WP Test Email
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WP Test Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Antideo Email Validator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68017 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Antideo Antideo Email Validator antideo-email-validator allows Blind SQL Injection.This issue affects Antideo Email Validator: from n/a through <= 1.0.10.
Product
Antideo Email Validator
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Antideo Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026WP Mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68008 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows Reflected XSS.This issue affects WP Mail: from n/a through <= 1.3.
Product
WP Mail
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026MailerLite – WooCommerce integration: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67945 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite – WooCommerce integration: from n/a through <= 3.1.2.
Product
MailerLite – WooCommerce integration
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update MailerLite – WooCommerce integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 20, 2026weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation: Authorization bypassCVE-2025-14348 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's REST API trusting the `x-wemail-user` HTTP header to identify users without verifying the request originates from an authenticated WordPress session. This makes it possible for unauthenticated attackers who know or can guess an admin email (easily enumerable via `/wp-json/wp/v2/users`) to impersonate that user and access the CSV subscriber endpoints, potentially exfiltrating subscriber PII (emails, names, phone numbers) from imported CSV files.
Product
weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 19, 2026Newsletter – Send awesome emails from: Cross-Site Request ForgeryCVE-2026-1051 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1.0. This is due to missing or incorrect nonce validation on the hook_newsletter_action() function. This makes it possible for unauthenticated attackers to unsubscribe newsletter subscribers via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.
Product
Newsletter – Send awesome emails from
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update Newsletter – Send awesome emails from to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2026CM E-Mail Blacklist – Simple email filtering for safer registration: Stored Cross-Site ScriptingCVE-2026-0691 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all versions up to, and including, 1.6.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
CM E-Mail Blacklist – Simple email filtering for safer registration
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update CM E-Mail Blacklist – Simple email filtering for safer registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Quick Contact Form: Open Mail RelayCVE-2025-12718 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form' AJAX endpoint allowing a user controlled parameter to set the 'from' email address. This makes it possible for unauthenticated attackers to send emails to arbitrary recipients utilizing the server. The information is limited to the contact form submission details.
Product
Quick Contact Form
Affected
up to 8.2.6
What to do
Affects up to 8.2.6. Update Quick Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2026LEAV Last Email Address Validator: Cross-Site Request ForgeryCVE-2025-14853 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions <= 1.7.1. This is due to missing or incorrect nonce validation on the display_settings_page function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
LEAV Last Email Address Validator
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update LEAV Last Email Address Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026MailerLite - WooCommerce integration: Unauthorized data modification and deletionCVE-2026-1000 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to missing capability checks on the resetIntegration() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's integration settings, delete all plugin options, and drop the plugin's database tables (woo_mailerlite_carts and woo_mailerlite_jobs), resulting in complete loss of plugin data including customer abandoned cart information and sync job history.
Product
MailerLite - WooCommerce integration
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update MailerLite - WooCommerce integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 15, 2026Kalium 3 | Creative WordPress & WooCommerce: Unauthorized email sendingCVE-2025-12895 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf.
Product
Kalium 3 | Creative WordPress & WooCommerce
Affected
up to 3.29
What to do
Affects up to 3.29. Update Kalium 3 | Creative WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record documentation.laborator.co themeforest.net
Jan 7, 2026Optional Email: Privilege EscalationCVE-2025-15018 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts.
Product
Optional Email
Affected
up to 1.3.11
What to do
Affects up to 1.3.11. Update Optional Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026Newsletter Email Subscribe: Cross-Site Request ForgeryCVE-2025-14904 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect nonce validation on the nels_settings_page function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Newsletter Email Subscribe
Affected
up to 2.4
What to do
Affects up to 2.4. Update Newsletter Email Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026twinklesmtp – Email Service Provider For: Stored Cross-Site ScriptingCVE-2025-14887 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
twinklesmtp – Email Service Provider For
Affected
up to 1.03
What to do
Affects up to 1.03. Update twinklesmtp – Email Service Provider For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.