Mail Queue
Mail Queue has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Mail Queue has a vendor fix available, so running the current release closes it.
All of these findings were reported by Alex Thomas. Mail Queue is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2023-3167Mail Queue <= 1.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject
Read the full analysisVulnerability Records
Mail Queue
Author
WDM
This plugin enhances the security and stability of your WordPress installation by delaying and controlling wp_mail() email submissions through a managed queue. If your site exhibits unusual behavior, such as a spam bot repeatedly submitting forms, you will be alerted immediately and can optionally pause delivery automatically while you investigate. Intercepts wp_mail() and places outgoing messages in a queue Configure how many emails are sent and at what interval Pause the queue without disabling the plugin completely Log queued emails, sent emails, alerts, and queue events Receive alerts when the queue grows unexpectedly Optionally auto-pause the queue when an alert is triggered Send selected queued emails immediately from the backend Automatically prioritize WordPress password reset emails Receive alerts when WordPress is unable to send emails
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C