189 matches found
CVE-2026-118167
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any...
EUVD-2026-117912
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any...
WordPress Essential Real Estate plugin < 5.3.5 - Unauthenticated Arbitrary Email Sending vulnerability
Unauthenticated Arbitrary Email Sending vulnerability discovered by Artus KG in WordPress Plugin Essential Real Estate versions 5.3.5...
EUVD-2026-117344
The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site...
CVE-2026-90964
The Essential Real Estate WordPress plugin versions prior to 5.3.5 contains a vulnerability that fails to restrict the recipient of one of its contact email actions. This allows unauthenticated users to send emails to arbitrary addresses using an attacker-controlled sender header and message body...
CVE-2026-90964 Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending
The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site...
CVE-2026-115303
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticate...
WordPress Royal Elementor Addons plugin < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection vulnerability
Unauthenticated Arbitrary Email Recipient Injection vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Royal Elementor Addons versions 1.7.1070...
CVE-2026-94235 Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...
WordPress MemberHero plugin <= 6.9 - Subscriber+ Arbitrary Email Sending vulnerability
Subscriber+ Arbitrary Email Sending vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simple User Registration versions = 6.9...
CVE-2026-94235
The MemberHero WordPress plugin (version 6.9 and below) is vulnerable to an arbitrary email sending flaw due to a missing capability and nonce check on an AJAX action. Specifically, the wpr_send_email_to_user function allows any authenticated user , such as a subscriber, to force the site to send...
CVE-2026-94235 Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...
PT-2026-110068
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...
BIT-GHOST-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...
Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215
The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Example" feature implemented by the emailexample submodule can be used to send illegitimate emails to arbitrary email addresses. Therefore, the...
Reliance on Untrusted Inputs in a Security Decision
Overview ghost is a publishing platform Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the staff invite signup flow, where the email field in the invitation acceptance form was editable and user-supplied rather than being populated and...
CVE-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...
CVE-2026-103267
Ghost versions before 6.62.0 are vulnerable to an authentication bypass during the staff invite acceptance process. This flaw allows users to specify arbitrary email addresses when creating an account. Specifically, attackers can utilize leaked invite tokens to register with attacker-controlled e...
EUVD-2026-90661
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...
CVE-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...