195 matches found
CVE-2025-32694: URL Redirection to Untrusted Site
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Phishing.This issue affects Ultimate WP Mail: from n/a through = 1.3.10...
CVE-2024-47339
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JWardee WP Mail Catcher wp-mail-catcher allows Reflected XSS.This issue affects WP Mail Catcher: from n/a through = 2.1.9...
CVE-2024-47339
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JWardee WP Mail Catcher wp-mail-catcher allows Reflected XSS.This issue affects WP Mail Catcher: from n/a through = 2.1.9...
CVE-2024-47339
CVE-2024-47339 is a WordPress WP Mail Catcher vulnerability: an improper input neutralization during page generation enables Reflected XSS in WP Mail Catcher versions = 2.1.10 to mitigate the issue. If upgrading is not immediately feasible, applying mitigations that block or sanitize user-supplie...
CVE-2024-47339: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JWardee WP Mail Catcher wp-mail-catcher allows Reflected XSS.This issue affects WP Mail Catcher: from n/a through = 2.1.9...
WordPress WP Mail Catcher plugin <= 2.1.9 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin WP Mail Catcher versions = 2.1.9...
WordPress WP Mail SMTP by WPForms Plugin <= 4.0.1 is vulnerable to Sensitive Data Exposure
Software WP Mail SMTP by WPForms Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.1.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6694 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID 45f83918c270 Credits Guus Verbeek...
CVE-2024-6694
CVE-2024-6694 affects the WP Mail SMTP plugin for WordPress up to version 4.0.1. An authenticated admin can view the SMTP password in the SMTP Password field when viewing settings, leading to information exposure of the configured mail server credentials. The documented impact is limited to infor...
CVE-2024-6694: Storing Passwords in a Recoverable Format
The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with...
WP Mail Catcher < 2.1.7 - Cross-Site Request Forgery
Description The WP Mail Catcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.6. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform unauthorized actions...
CVE-2024-32099
Cross-Site Request Forgery CSRF vulnerability in James Ward WP Mail Catcher.This issue affects WP Mail Catcher: from n/a through 2.1.6...
CVE-2024-32099 WordPress WP Mail Catcher plugin <= 2.1.6 - Cross Site Request Forgery vulnerability
Cross-Site Request Forgery CSRF vulnerability in James Ward WP Mail Catcher.This issue affects WP Mail Catcher: from n/a through 2.1.6...
CVE-2024-32099 WordPress WP Mail Catcher plugin <= 2.1.6 - Cross Site Request Forgery vulnerability
Cross-Site Request Forgery CSRF vulnerability in James Ward WP Mail Catcher.This issue affects WP Mail Catcher: from n/a through 2.1.6...
CVE-2024-32099
CVE-2024-32099 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Mail Catcher WordPress plugin, affecting WP Mail Catcher versions up to 2.1.6. The vulnerability is documented with a CVSS v3.1 base score of 4.3 (Medium) and vectors including Network attack, Low attack complexity, No ...
CVE-2024-32099: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in James Ward WP Mail Catcher.This issue affects WP Mail Catcher: from n/a through 2.1.6...
WP Mail Log < 1.1.3 - Editor+ SQL Injection via id
Description The plugin is vulnerable to SQL Injection via the ‘id’ parameter due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
WP Mail Log Plugin < 1.1.3 - Contributor+ Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'sendemail' function. This makes it possible for authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's server which may make remote code...
CVE-2023-51410
Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2...
