Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,374 results · page 14 of 48
May 7, 2025Email Notification on Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47622 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Email Notification on Login email-notification-on-login allows Stored XSS.This issue affects Email Notification on Login: from n/a through <= 1.7.0.
- Product
- Email Notification on Login
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Email Notification on Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025SendPulse Email Marketing Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47547 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.1.6.
- Product
- SendPulse Email Marketing Newsletter
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update SendPulse Email Marketing Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025weMail: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-47540 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs weMail wemail allows Retrieve Embedded Sensitive Data.This issue affects weMail: from n/a through <= 1.14.13.
- Product
- weMail
- Affected
- up to 1.14.13
- What to do
- Affects up to 1.14.13. Update weMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 5, 2025Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails CVE-2025-2545 · Other software · Best Practical Solutions · reported by cve-coordination@incibe.esLow 2.3
Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe.esdocs.bestpractical.com
Apr 29, 2025An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below.CVE-2025-3929 · Other software · MDaemon · reported by security@eset.comMedium 5.3
An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.
- Product
- Email Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emailCVE-2024-11922 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 6.3
Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025Make Email Customizer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32511 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Excellent Dynamics Make Email Customizer for WooCommerce make-email-customizer-for-woocommerce allows Reflected XSS.This issue affects Make Email Customizer for WooCommerce: from n/a through <= 1.0.6.
- Product
- Make Email Customizer for WooCommerce
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Make Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Event Espresso – Custom Email Template Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Event Espresso – Custom Email Template Shortcode email-shortcode allows Reflected XSS.This issue affects Event Espresso – Custom Email Template Shortcode: from n/a through <= 1.0.0.
- Product
- Event Espresso – Custom Email Template Shortcode
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Event Espresso – Custom Email Template Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025FireDrum Email Marketing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31018 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FireDrum FireDrum Email Marketing firedrum-email-marketing allows Reflected XSS.This issue affects FireDrum Email Marketing: from n/a through <= 1.64.
- Product
- FireDrum Email Marketing
- Affected
- up to 1.64
- What to do
- Affects up to 1.64. Update FireDrum Email Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Simple Email Subscriber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27354 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phil88530 Simple Email Subscriber simple-email-subscriber allows Reflected XSS.This issue affects Simple Email Subscriber: from n/a through <= 2.3.
- Product
- Simple Email Subscriber
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Simple Email Subscriber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Cloak Front End Email: Missing AuthorizationCVE-2025-26968 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in webbernaut Cloak Front End Email allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cloak Front End Email: from n/a through 1.9.5.
- Product
- Cloak Front End Email
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update Cloak Front End Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025DeBounce Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24539 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows Reflected XSS.This issue affects DeBounce Email Validator: from n/a through <= 5.6.5.
- Product
- DeBounce Email Validator
- Affected
- up to 5.6.5
- What to do
- Affects up to 5.6.5. Update DeBounce Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Icegram Express formerly known as Email Subscribers: Does not sanitise and escape some of its settingsCVE-2024-11924 · WordPress plugins & themes · reported by WPScanLow 3.5
The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Express formerly known as Email Subscribers
- Fixed in
- 5.7.52
- What to do
- Update Icegram Express formerly known as Email Subscribers to 5.7.52 or newer.
Apr 16, 2025Kadence WooCommerce Email Designer: Unrestricted Upload of File with Dangerous TypeCVE-2025-39557 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Upload a Web Shell to a Web Server.This issue affects Kadence WooCommerce Email Designer: from n/a through <= 1.5.14.
- Product
- Kadence WooCommerce Email Designer
- Affected
- up to 1.5.14
- What to do
- Affects up to 1.5.14. Update Kadence WooCommerce Email Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.CVE-2025-29471 · Other software · Nagios · reported by MITREHigh 8.3
Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.
- Product
- LOG Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comnagios.com
Apr 15, 2025Macro Calculator with Admin Email Optin & Data: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26730 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator with Admin Email Optin & Data. This issue affects Macro Calculator with Admin Email Optin & Data: from n/a through 1.0.
- Product
- Macro Calculator with Admin Email Optin & Data
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Macro Calculator with Admin Email Optin & Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025An attacker can change registered email addresses of other users and take over arbitrary accounts.CVE-2025-27939 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker can change registered email addresses of other users and take over arbitrary accounts.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can get users' emails by knowing usernames.CVE-2025-27568 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering overCVE-2025-3523 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.4
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 15, 2025Email Notifications for Updates: Missing AuthorizationCVE-2025-26741 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in AWEOS GmbH Email Notifications for Updates wp-update-mail-notification allows Privilege Escalation.This issue affects Email Notifications for Updates: from n/a through <= 1.1.6.
- Product
- Email Notifications for Updates
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Email Notifications for Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025WordPress SMTP Service, Email Delivery Solved! — MailHawk: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31015 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Adrian Tobey WordPress SMTP Service, Email Delivery Solved! — MailHawk mailhawk allows PHP Local File Inclusion.This issue affects WordPress SMTP Service, Email Delivery Solved! — MailHawk: from n/a through <= 1.3.1.
- Product
- WordPress SMTP Service, Email Delivery Solved! — MailHawk
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update WordPress SMTP Service, Email Delivery Solved! — MailHawk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025DeBounce Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32580 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows Stored XSS.This issue affects DeBounce Email Validator: from n/a through <= 5.7.1.
- Product
- DeBounce Email Validator
- Affected
- up to 5.7.1
- What to do
- Affects up to 5.7.1. Update DeBounce Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Email Notifications for Updates: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2933 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26741 is likely a duplicate of this issue.
- Product
- Email Notifications for Updates
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Email Notifications for Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 4, 2025A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplieCVE-2025-2244 · Other software · Bitdefender · reported by cve-requests@bitdefender.comCritical 9.5
A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.
- Product
- GravityZone Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025DeBounce Email Validator: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31098 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows PHP Local File Inclusion. This issue affects DeBounce Email Validator: from n/a through <= 5.7.
- Product
- DeBounce Email Validator
- Affected
- up to 5.7
- What to do
- Affects up to 5.7. Update DeBounce Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2025A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of serviceCVE-2025-20139 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a messaging chat entry point in the affected application. A successful exploit could allow the attacker to cause the application to stop responding, resulting in a DoS condition. The application may not recover on its own and may need an administrator to manually restart services to recover.
- Product
- Cisco Enterprise Chat and Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Mar 31, 2025Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.CVE-2025-31676 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.8
Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.
- Product
- Email TFA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025PostmarkApp Email Integrator: Cross-Site Request Forgery (CSRF)CVE-2025-31617 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Cross Site Request Forgery.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.
- Product
- PostmarkApp Email Integrator
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025PostmarkApp Email Integrator: Missing AuthorizationCVE-2025-31576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.
- Product
- PostmarkApp Email Integrator
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 29, 2025DAP to Autoresponders Email Syncing: Sensitive Information ExposureCVE-2025-2840 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
- Product
- DAP to Autoresponders Email Syncing
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update DAP to Autoresponders Email Syncing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 28, 2025ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.CVE-2025-28093 · Other software · Shopxo · reported by MITREMedium 6.3
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.
- Product
- Shopxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an emailCVE-2025-2910 · Other software · Fermax · reported by cve-coordination@incibe.esMedium 6.9
User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an email address is registered through specific error messages.
- Product
- MeetMe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025publish post email notification: Cross-Site Request Forgery (CSRF)CVE-2025-30816 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nks publish post email notification publish-post-email-notification allows Cross Site Request Forgery.This issue affects publish post email notification: from n/a through <= 1.0.2.3.
- Product
- publish post email notification
- Affected
- up to 1.0.2.3
- What to do
- Affects up to 1.0.2.3. Update publish post email notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Clearout Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30789 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in clearoutio Clearout Email Validator clearout-email-validator allows Stored XSS.This issue affects Clearout Email Validator: from n/a through <= 3.2.0.
- Product
- Clearout Email Validator
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Clearout Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2025SH Email Alert: Reflected Cross-Site ScriptingCVE-2025-2165 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- SH Email Alert
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update SH Email Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 24, 2025Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS.CVE-2024-9103 · Other software · Forcepoint · reported by psirt@forcepoint.comMedium 6.1
Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issue affects Email Security through 8.5.5.
- Product
- Email Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.forcepoint.com
Mar 24, 2025WP e-Commerce Style Email: Cross-Site Request Forgery (CSRF)CVE-2025-30615 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Code Injection.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.
- Product
- WP e-Commerce Style Email
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update WP e-Commerce Style Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 22, 2025Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: SQL InjectionCVE-2025-2186 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via the ‘automationId’ parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 21, 2025Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function.CVE-2025-29230 · Network & remote access · Linksys · reported by MITREHigh 8.6
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter.
- Product
- E5600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections iCVE-2025-0431 · Other software · Proofpoint · reported by security@proofpoint.comMedium 5.8
Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email. This occurs due to improper filtering of backslashes within URLs and affects all versions of 8.21, 8.20 and 8.18 prior to 8.21.0 patch 5115, 8.20.6 patch 5114 and 8.18.6 patch 5113 respectively.
- Product
- Enterprise Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2025WP Test Email: Stored Cross-Site ScriptingCVE-2025-2325 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Test Email
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update WP Test Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 11, 2025No Disposable Email: Cross-Site Request Forgery (CSRF)CVE-2025-28923 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in philippe No Disposable Email no-disposable-email allows Stored XSS.This issue affects No Disposable Email: from n/a through <= 2.5.1.
- Product
- No Disposable Email
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update No Disposable Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025BP Email Assign Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28875 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Stored XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.6.
- Product
- BP Email Assign Templates
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025BP Email Assign Templates: Authorization Bypass Through User-Controlled KeyCVE-2025-28874 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Email Assign Templates: from n/a through <= 1.7.
- Product
- BP Email Assign Templates
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 10, 2025Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messagesCVE-2025-27913 · Other software · Passbolt · reported by MITRELow 2.1
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
- Product
- API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown CVE-2025-26696 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7
Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 10, 2025When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested emailCVE-2025-26695 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 10, 2025The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing maliciCVE-2025-2150 · Other software · HGiga · reported by twcert@cert.org.twMedium 5.4
The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malicious JavaScript code, which will be executed in the recipient's browser when they view the email.
- Product
- C&Cm@il
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 8, 2025Email Keep: Does not have CSRF check in placeCVE-2024-13826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Email Keep
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Email Keep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 8, 2025Email Keep: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13825 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Email Keep
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Email Keep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.