Send From

Send From has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 5.5 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Send From has a vendor fix available, so running the current release closes it.

All of these findings were reported by Nabil Irawan. Send From is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.10.

Strategic Overview

Avg CVSSMedium
5.5/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Send From vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.5CVE-2025-46469

Send From <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Plugin Profile
Latestv2.5
5.0(8)
100/100
Last Updated
2025-10-10 (11mo ago)
Active Installs
500+
Downloads
14,997
Requires WP
5.9+
Requires PHP
0+
Tested up to
WP 6.4.10
Created
2009-12-21 (17y ago)

I have issues with my hosting service not allowing me to easily set the &#8216;From line’ for my server email. Whenever a new user signs up they see username@hostingservice.com even though they should see user@site.com. Before Send From you would be required to modify your installation of WordPress just about every time you do an update. No longer! With Send From, you simply go into your admin panel and set what the end user will see on their emails from line. Support Questions If there are any issues that crop up, I will be happy to take a look at solving them. However, due to many factors, I can’t offer active support for the plugin. Security CVE: CVE-2025-46469 – Cross-site scripting (Stored XSS) in plugin settings. Summary: A stored XSS issue was reported in older versions of this plugin where un-sanitized input saved in plugin options could later be rendered into the admin interface without proper escaping. The repository has been updated to sanitize incoming option values and escape output when rendering form fields. The plugin also validates the test-send email address. Mitigation applied in this repository: – Sanitize email values with WordPress’ sanitize_email() before saving. – Sanitize name fields with sanitize_text_field() before saving. – Escape values when printed into HTML attributes using esc_attr(). – Validate test-send addresses with is_email() and refuse to save invalid addresses.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C