CVE-2026-65547 WordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerability

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

EUVD-2026-53977

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

CVE-2026-65547

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

CVE-2026-65547 WordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerability

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

CVE-2026-14547

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...

CVE-2026-14547 Estatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...

CVE-2026-14547

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...

CVE-2026-14547 Estatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...

CVE-2026-14547

The Estatik Real Estate Plugin for WordPress (versions before 4.3.3 ) is vulnerable to an unauthenticated mail relay due to insufficient anti-spam checks and unrestricted recipient routing within its property request form. This flaw allows attackers to send emails to arbitrary recipients with cus...

PT-2026-68373

Name of the Vulnerable Software and Affected Versions FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider versions prior to 2.2.96 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored...

CVE-2026-3430: Improper Neutralization of Special Elements used in an SQL Command

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...

CVE-2026-14547: Improper Authentication

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively...

PT-2026-68394

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin versions prior to 4.3.3 Description This issue occurs because the property request form does not properly enforce anti-spam checks or restrict recipient routing. This allows unauthenticated users to send emails to...

PT-2026-68617

Name of the Vulnerable Software and Affected Versions Creative Mail versions 1.6.5 through 1.6.9 Description The Creative Mail WordPress plugin fails to sanitize and escape a parameter before incorporating it into an SQL statement. This flaw allows an unauthenticated user to perform an SQL...

CVE-2026-65547: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

Mail contact autocomplete bypasses administrator-configured user enumeration restrictions

None...

CVE-2026-71239

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

CVE-2026-71244

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244

Paperless-ngx: The MailAccountViewSet.test() action can reuse stored credentials (IMAP password/OAuth token) from an existing account when a caller with object-level change_mailaccount permission redirects the test connection to an attacker-controlled IMAP host, causing exposure of real credentia...

EUVD-2026-53317

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...