WP Mail

WP Mail has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2026; 1 is fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).

1 of the records (33%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2025.

3 independent researchers contributed these findings, one record each. WP Mail is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.6.30.

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage33%

Open

Fixed

Get automatic notifications for all WP Mail vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-58822

WP Mail <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records


2026-01-16 00:00	Mail <= 1.3 - Reflected Cross-Site Scripting WP Mail <= 1.3	`CVE-2025-68008`	6.1 Medium	Skalucy	No
2025-09-05 00:00	WP Mail <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting WP Mail <= 1.3	`CVE-2025-58822`	6.4 Medium	Peter Thaleikis	No
2016-07-23 00:00	WP Mail <= 1.1 - Reflected Cross-Site Scripting WP Mail < 1.2	`CVE-2017-5942`	6.1 Medium	iamcjc	Yes

Showing 1–3 of 3 reports

Latestv1.3

WP Mail

Author

mndpsingh287

5.0(1)

100/100

Last Updated

2016-10-06 (10y ago)

Active Installs

500+

Downloads

10,744

Requires WP

3.4+

Requires PHP

Tested up to

WP 4.6.30

Created

2016-07-22 (10y ago)

WP Mail plugin is simply a wp network mail or message system. User can send mail or messages to other users over one wp network. Key Features of WP Mail WP Mail – It allows WordPress administrators as well as wordpress users to send/recieve emails to registered users with in respective wordpress environment or manually typed in registered user’s email addresses. Multiuser mails – You can send mails to multiple users by adding comma seprated mail ids ex:test@domain.com,test2@domain.com. Mail as draft – WP users can save message in draft. How to use First Activate Plugin. Go to Wp Mail Menu To Create New Mail – Click Compose Menu To Check Message – Click Indox Menu= Minimum requirements for Mail System = * WordPress 3.3+ * PHP 5.x * MySQL 5.x If any problem occurs, please contact us at http://www.webdesi9.com/support/.

View on WordPress.org