FireDrum Email Marketing
FireDrum Email Marketing has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for FireDrum Email Marketing has a vendor fix available, so running the current release closes it.
All of these findings were reported by johska. FireDrum Email Marketing is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-31018FireDrum Email Marketing <= 1.64 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
FireDrum Email Marketing
Author
FireDrum
Grow your email list directly from your WordPress site. The FireDrum Email Marketing plugin connects your website to your FireDrum account and makes it easy to create, customize, and display opt-in forms — no coding required. Form Types Inline / Shortcode — embed a signup form anywhere on your site using a shortcode or widget Modal Popup — display a popup triggered immediately, after a delay, on exit intent, or after the visitor scrolls a set percentage of the page Sticky Bar — show a persistent top or bottom bar to capture signups without interrupting the browsing experience Display & Targeting Show forms everywhere, on the front page, on specific pages, or on WooCommerce pages Cookie-based suppression — control how long before the form shows again after dismissal Trigger options: immediately, after a delay, on exit intent, or after scroll % Form Builder Choose which standard fields to display: name, address, phone, birthday, anniversary, and more Include custom fields from your FireDrum account Assign forms to one or more contact lists Double opt-in support Anti-spam honeypot Signup notification emails Styling Match Theme mode — forms automatically inherit your WordPress theme’s styles Custom mode — set button colors, text color, background color, border, font, and size Custom CSS with a form-specific class placeholder Inline or stacked layout mode Hide labels or use placeholder text instead Live Preview Preview your form directly in the WordPress editor sidebar Mobile, Tablet, and Desktop preview sizes Modal forms preview as a true popup overlay Integrations WooCommerce — display opt-in forms at checkout and send abandoned cart recovery emails Gravity Forms — sync form submissions to your FireDrum lists Divi / Bloom — connect Bloom opt-in forms to FireDrum
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C