54429 matches found
CVE-2026-81764
Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...
CVE-2026-81290
Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...
CVE-2026-61641
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...
CVE-2026-61638
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...
CVE-2026-77351
Wallos , an open-source self-hosted personal subscription tracker, is vulnerable to SSRF prior to version 5.0.0 . The root cause is that any authenticated user can store an arbitrary SMTP host—including private and cloud-metadata IP addresses—in their personal email notification settings, with no...
CVE-2026-77351 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...
CVE-2026-77351 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...
CVE-2026-61641
Wallos (open-source personal subscription tracker) versions 4.0.0 through before 4.9.6 contain an OIDC login flaw where an incoming identity is linked to an existing local account by matching the email claim alone, without verifying the IdP's email_verified attribute. When the configured IdP allo...
CVE-2026-61641 Wallos: OIDC account takeover via email-based account linking without `email_verified` check
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...
EUVD-2026-68812
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...
CVE-2026-61641 Wallos: OIDC account takeover via email-based account linking without `email_verified` check
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...
CVE-2026-61638 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...
CVE-2026-61638 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...
EUVD-2026-68804
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...
CVE-2026-81764 WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...
EUVD-2026-68788
Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...
CVE-2026-81764 WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...
CVE-2026-81764
CVE-2026-81764 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Email Essentials plugin, affecting versions 6.0.6 and earlier . Discovered by JunHee CHO , the flaw allows an attacker to inject script via the network with low complexity and no prior privileges , thou...
EUVD-2026-68778
Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...
CVE-2026-81290 WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...