MultiMailer
MultiMailer has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
None of the 2 issues recorded for MultiMailer have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. MultiMailer is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.6.7.
CVE-2025-32517MultiMailer <= 1.0.3 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
MultiMailer
Author
SCAND
This WordPress email plugin allows you to intercept an email that is sent by wp_mail() function and duplicates it as many times as you need. Then, upon your request, the plugin could process it in the following way: send the email to multiple recipients; differentiate data sets while sending it to multiple recipients; add the information about the emails sent to log; add some text before or after the message body; replace sender’s text, name (field From Name), subject, and even the recipients if needed. You can set the following options: Specify the form name and email address for the outgoing email. Specify the email(s) of recipient (s). Specify the text that could be prepended to the message body. Choose to send the mail by SMTP or PHP’s mail() function. Specify the SMTP settings: host, port, username and password. Choose SSL / TLS encryption (different from STARTTLS). Choose to use of SMTP authentication or not (as it is by default).
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C