EUVD-2026-53721

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...

CVE-2026-16636

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

CVE-2026-16636

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

CVE-2026-16636 FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

CVE-2026-16636

The CVE concerns FluentSMTP

CVE-2026-16636 FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

EUVD-2026-53702

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

feedparser-redos-poc

feedparser ReDoS PoC syncauthordetail Minimal, deter...

CVE-2026-16636: Improper Neutralization of Input During Web Page Generation

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

PT-2026-68479

Name of the Vulnerable Software and Affected Versions Element Pack Addons for Elementor versions prior to 8.3.16 Description An Email Header Injection issue exists due to insufficient sanitization of newline characters in user-supplied input that is concatenated into email headers. This allows...

CVE-2026-0673: Improper Neutralization of CRLF Sequences

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...

PT-2026-68444

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The system fails to properly validate authentication requests when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators, which prevents the...

WP < 7.0.3 - Subscriber+ Email Change Confirmation Bypass

Description WordPress does not always validate a new email address consistently when a profile is updated, which could allow any authenticated user to change their account email address without completing the ownership confirmation step...

PT-2026-68373

Name of the Vulnerable Software and Affected Versions FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider versions prior to 2.2.96 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored...

CVE-2026-3430: Improper Neutralization of Special Elements used in an SQL Command

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...

CVE-2026-28005: Missing Authorization

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer = 1.5.19 versions...

PT-2026-68803

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.3 Statamic versions prior to 6.24.2 Description The default form notification email renders user-submitted values without proper escaping. This allows an unauthenticated user to inject HTML into the notification...

PT-2026-68948

Impact When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a...

PT-2026-68617

Name of the Vulnerable Software and Affected Versions Creative Mail versions 1.6.5 through 1.6.9 Description The Creative Mail WordPress plugin fails to sanitize and escape a parameter before incorporating it into an SQL statement. This flaw allows an unauthenticated user to perform an SQL...

PT-2026-68770

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.1 Statamic versions prior to 6.24.0 Description When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker can sign in as an existing user, includin...