MailArchiver

MailArchiver has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include SQL Injection.

Every one of the 3 issues recorded for MailArchiver has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Ronnachai Chaipha (rxnr). MailArchiver is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.6/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all MailArchiver vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2023-3136

MailArchiver <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject

Read the full analysis

Vulnerability Records

3 records
Plugin Profile
Latestv4.7.0
5.0(3)
100/100
Last Updated
2026-08-18 (25d ago)
Active Installs
100+
Downloads
12,313
Requires WP
6.4+
Requires PHP
8.2+
Tested up to
WP 7.1
Created
2019-12-02 (7y ago)

Automatically archive all emails sent from your site. Store them in your WordPress database or send them to external services. MailArchiver is a tool that allows you to: catch emails sent by WordPress itself or plugins; enrich them with details regarding their sending; archive them in the WordPress database and/or send them to external services for logging and alerting; view (and filter) archived emails in the WordPress database. It supports multisite archive delegation (see FAQ) and contains many features to help to protect personal information (user pseudonymization, IP obfuscation, etc.). At this time, MailArchiver can archive emails: to its internal archiving storage and viewer; to local or network storage (with file rotation); to Imap servers, like GMail, Gandi, OVH or Outlook.Com; to external storage services, like Elasticsearch, Elastic Cloud, Loki or Grafana Cloud; to external alerting services, like Pushover or Slack; to external testing & previewing services, like Litmus, MailerCheck or Email on Acid; to external logging services, like Logentries / insightOps or Loggly; to system loggers, like Syslog or Fluentd. For a full list of supported – internal or third-party – services please, jump to the official supported services list. MailArchiver supports an extensive set of WP-CLI commands to: decrypt a previously encrypted mail body – see wp help m-archive decrypt for details; toggle on/off main settings – see wp help m-archive settings for details; manage archivers (list, start, pause, clean, purge, remove, add and set) – see wp help m-archive archiver for details; view available archiver types (list and describe) – see wp help m-archive type for details. For a full help on WP-CLI commands in MailArchiver, please read this guide. MailArchiver is part of PerfOps One, a suite of free and open source WordPress plugins dedicated to observability and operations performance. MailArchiver is a free and open source plugin for WordPress. It integrates many other free and open source works (as-is or modified). Please, see &#8216;about’ tab in the plugin settings to see the details. Support This plugin is free and provided without warranty of any kind. Use it at your own risk, I’m not responsible for any improper use of this plugin, nor for any damage it might cause to your site. Always backup all your data before installing a new plugin. Anyway, I’ll be glad to help you if you encounter issues when using this plugin. Please read carefully the FAQ at the bottom of this page before requesting support. Privacy This plugin, as any piece of software, is neither compliant nor non-compliant with privacy laws and regulations. It is your responsibility to use it – by activating the corresponding options or services – with respect for the personal data of your users and applicable laws. This plugin doesn’t set any cookie in the user’s browser. This plugin may handle personally identifiable information (PII). If the GDPR or CCPA or similar regulation applies to your case, you must use the anonymization options embedded in the plugin and/or adapt your processes (consent management, security measure, treatment register, etc.). Donation If you like this plugin or find it useful and want to thank me for the work done, please consider making a donation to La Quadrature Du Net or the Electronic Frontier Foundation which are advocacy groups defending the rights and freedoms of citizens on the Internet. By supporting them, you help the daily actions they perform to defend our fundamental freedoms!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C