84 matches found
WordPress weMail < 2.1.3 - Cross-Site Scripting
The weMail plugin for WordPress 2.1.3 is vulnerable to reflected cross-site scripting. The plugin does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response. id: CVE-2026-8089 info: name: WordPress weMail 2.1.3 - Cross-Sit...
CVE-2026-104648
The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to...
CVE-2026-104647
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list Editor and above by default as authorised for every action, which allows such...
EUVD-2026-115683
The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to...
CVE-2026-104648 weMail <= 2.1.6 - Editor+ API Key Disclosure
The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to...
CVE-2026-104647 weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list Editor and above by default as authorised for every action, which allows such...
WordPress weMail plugin <= 2.1.6 - Editor+ API Key Disclosure vulnerability
Editor+ API Key Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin weMail versions = 2.1.6...
WordPress weMail plugin <= 2.1.6 - Editor+ Incorrect Authorization vulnerability
Editor+ Incorrect Authorization vulnerability discovered by Dishant Modi in WordPress Plugin weMail versions = 2.1.6...
CVE-2026-104648
The weMail WordPress plugin (versions through 2.1.6 ) contains an API Key Disclosure vulnerability. The plugin fails to restrict access to a site-wide third-party email-service API key to administrators, exposing it on an admin screen accessible by users with the Editor role. An attacker with Edi...
EUVD-2026-115684
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list Editor and above by default as authorised for every action, which allows such...
CVE-2026-104647
The weMail WordPress plugin (versions through 2.1.6 ) contains an incorrect authorization vulnerability in its REST API permission checks. The plugin fails to properly verify user capabilities, instead granting full authorization to any user whose role is included in the plugin's allowed-roles li...
CVE-2026-57322
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2...
CVE-2026-57322
Unauthenticated Cross Site Scripting XSS in weMail = 2.1.2 versions...
EUVD-2026-39734
Unauthenticated Cross Site Scripting XSS in weMail = 2.1.2 versions...
CVE-2026-57322 WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2...
CVE-2026-57322 WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2...
CVE-2026-57322
CVE-2026-57322 is an Unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress weMail plugin, version <= 2.1.2. The connected documents identify it as a Reflected XSS in weMail
WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin weMail versions = 2.1.2...
PT-2026-52788
Unauthenticated Cross Site Scripting XSS in weMail = 2.1.2 versions...
CVE-2026-57322: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2...