WordPress plugin WP-EMail 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. WordPress plugin WP-EMail version 2.69.0 has a security vulnerability that stems from obtaining a...

WP-Email < 2.69.0 - Anti-Spam Protection Bypass via IP Spoofing

The plugin prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based anti-spamming restrictions. Set HTTPCLIENTIP, HTTPXFORWARDEDFOR or any of the other headers used in getipaddress. curl...

CVE-2021-24959

The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks...

Sql injection

The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks...

CVE-2021-24959

The CVE-2021-24959 issue affects the WordPress plugin WP Email Users (

CVE-2021-24959: Improper Neutralization of Special Elements used in an SQL Command

The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks...

WP-EMail <= 2.67.2 - Cross-Site Scripting (XSS)

If the Plugin is activated then the email submission form can be found on the /email/ directory on individual Post/Pages. For example: http://example.com/2017/05/31/hello-world/email/...

WP-EMail <= 2.67.1 - SQL Injection

If the Plugin is activated then the email submission form can be found on the /email/ directory on individual Post/Pages. For example: http://example.com/2017/05/31/hello-world/email/...

Wordpress WP-EMail 2.64 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress WP-EMail 2.64 Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/wp-email/ Date : 2015-01-03 Software Link :...