Mass Email To Users
Mass Email To Users has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Mass Email To Users has a vendor fix available, so running the current release closes it.
All of these findings were reported by minhtuanact. Mass Email To Users is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2022-47600Mass Email To users <= 1.1.4 - Unauthenticated Reflected Cross-Site Scripting via 'entrant'
Read the full analysisVulnerability Records

Mass Email To Users
Author
Nks
Mass Email To Users lets you send HTML emails to your registered WordPress users straight from the WordPress admin. No Mailchimp account. No monthly fee. No external service required. Send to everyone with one click using Send Email To All Users, filter recipients by role, search and select individual users, and personalise every email with placeholders like [first_name] and [user_email]. ⭐ Get the Pro Version — Tracking, Automation & WooCommerce, $19 one-time → Free Version Features Send Email To All Users — one click reaches every registered user, no manual selection needed Filter by user role — Administrators, Editors, Subscribers, Customers, etc. Personalisation placeholders — [first_name], [last_name], [user_email], [display_name], [username] Working unsubscribe links — [unsubscribe_link_html] / [unsubscribe_link_plain] placeholders generate one-click unsubscribe links with a branded confirmation page Unsubscribers List — view everyone who unsubscribed and re-subscribe them with one click Select individual users, search by email/username/name, with pagination for large user lists HTML email support — write rich formatted emails using the WordPress editor Add users to an email queue across multiple pages WordPress capabilities / roles support — control exactly who can send mass emails No advertising, no branding added to your emails WordPress multisite compatible 🚀 Pro Version — Everything in Free, Plus: Tracking & Analytics * Open tracking — see who opened your email and when * Click tracking — see which links were clicked * Campaign Stats dashboard — open rates and click rates per campaign, visualised Audience Segmentation * WooCommerce segmentation — filter by purchase history, product bought, total spent, order status (supports WooCommerce HPOS) * Simple Membership levels & BuddyPress profile fields * CSV Import — upload external email lists and send to them alongside WordPress users Sending & Automation * Newsletter queue with cronjob — set your send rate and walk away * Scheduled sending — pick a future date and time * Email attachments — attach PDFs, images, documents * Reply-To email field * Full TinyMCE WYSIWYG email editor + saved email templates * Welcome Email Automation — auto-send when new users register, with optional delay * Bounce management — auto-unsubscribe after X failed sends Get Pro for $19 — One-Time Payment, 30-Day Money-Back Guarantee → Who Is This For? WordPress site owners who need to message their users without a monthly Mailchimp bill WooCommerce stores reaching customers (upgrade to Pro for purchase-based segmentation) Membership sites communicating with members by role or level Small businesses wanting a simple, self-hosted email tool they fully own Quick Start Install and activate the plugin Go to Mass Email in the WordPress admin sidebar (look for the envelope icon) Fill in Subject, From Name, From Email, and your message Click Send Email To All Users — or filter by role / search and select specific users, then click Send Email To Selected Users Personalisation Placeholders Add these anywhere in your subject line or email body — they’re replaced automatically per recipient: [first_name] `[last_name]` `[username]` `[user_email]` `[display_name]` `[nickname]` `[user_nicename]` For unsubscribe links: [unsubscribe_link_html] (clickable link) or [unsubscribe_link_plain] (plain URL) License This plugin is free for everyone. Released under the GPL, you can use it free of charge on your personal or commercial site.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C