Mailgun Subscriptions

Mailgun Subscriptions has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Mailgun Subscriptions has a vendor fix available, so running the current release closes it.

All of these findings were reported by Gilang - DJ. Mailgun Subscriptions is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Mailgun Subscriptions vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-11876

Mailgun Subscriptions <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records


2025-12-11 18:35	Mailgun Subscriptions <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Mailgun Subscriptions <= 1.3.1	`CVE-2025-11876`	6.4 Medium	Gilang - DJ	Yes

Showing 1–1 of 1 reports

Plugin Profile

Latestv1.3.3

Mailgun Subscriptions

Author

Jonathan Brinley

3.5(4)

70/100

Last Updated

2025-12-07 (9mo ago)

Active Installs

10+

Downloads

3,316

Requires WP

3.9+

Requires PHP

Tested up to

WP 6.9.7

Created

2014-09-21 (12y ago)

Add a Mailgun subscription form to your WordPress site. Your visitors can use the form to subscribe to your lists using the Mailgun API.

View on WordPress.org