115 matches found
CVE-2026-94174
Administrator SQL Injection in Email Log = 2.63 versions...
CVE-2026-94174 WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
Administrator SQL Injection in Email Log = 2.63 versions...
CVE-2026-94174
The WordPress Email Log plugin in versions
CVE-2026-94174 WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
Administrator SQL Injection in Email Log = 2.63 versions...
EUVD-2026-85474
Administrator SQL Injection in Email Log = 2.63 versions...
WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Email Log versions = 2.63...
CVE-2026-94174: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Email Log = 2.63 versions...
PT-2026-97459
Administrator SQL Injection in Email Log = 2.63 versions...
WordPress FluentSMTP cross-site scripting vulnerability
WordPress FluentSMTP is a fully free and powerful WordPress plugin designed to take over the default email sending mechanism wpmail. By configuring an external SMTP service, it improves the email delivery rate, and it supports multiple SMTP connection routes, such as distinguishing between...
CVE-2026-2471
The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybeunserialize on all properties retrieved...
CVE-2026-2471
The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybeunserialize on all properties retrieved...
CVE-2026-2471 WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field
The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybeunserialize on all properties retrieved...
CVE-2026-2471 WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field
The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybeunserialize on all properties retrieved...
CVE-2026-2471
The WP Mail Logging plugin for WordPress (up to version 1.15.0) is vulnerable to PHP Object Injection via deserialization of untrusted input in the email log message field. The BaseModel constructor calls maybe_unserialize() on all properties from the database without validation, allowing an unau...
CVE-2017-18603
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postmanemaillog page parameter...
400,000 WordPress Sites Affected by Account Takeover Vulnerability in Post SMTP WordPress Plugin
On October 11th, 2025, we received a submission for an Account Takeover via Email Log Disclosure vulnerability in Post SMTP, a WordPress plugin with more than 400,000 active installations. This vulnerability makes it possible for an unauthenticated attacker to view email logs, including password...
CVE-2025-10047: Improper Neutralization of Special Elements used in an SQL Command
The Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.3.15 due to insufficient escaping on the user supplied parameter and...
EUVD-2021-11836
Malware in sbrugna...