WP Mail Log

WP Mail Log has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2023; all 8 are fixed as of September 2026. Their average CVSS score is 7.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 5 high. 2023 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (25%). Other recurring categories include SQL Injection, Cross-Site Request Forgery (CSRF).

Every one of the 8 issues recorded for WP Mail Log has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (4) reported by dc11. WP Mail Log is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh

7.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP Mail Log vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2023-51410

WP Mail Log Plugin <= 1.1.2 - Authenticated(Contributor+) Arbitrary File Upload

Read the full analysis

Vulnerability Records

8 records


2023-12-27 00:00	WP Mail Log Plugin <= 1.1.2 - Authenticated(Contributor+) Arbitrary File Upload WP Mail Log < 1.1.3	`CVE-2023-51410`	8.8 High	Rafie Muhammad	Yes
2023-11-28 00:00	WP Mail Log <= 1.1.2 - Authenticated (Contributor+) SQL injection via key WP Mail Log <= 1.1.2	`CVE-2023-5645`	8.8 High	dc11	Yes
2023-11-28 00:00	WP Mail Log <= 1.1.2 - Authenticated (Contributor+) Arbitrary File Read WP Mail Log <= 1.1.2	`CVE-2023-5672`	6.5 Medium	dc11	Yes
2023-11-28 00:00	WP Mail Log <= 1.1.2 - Incorrect Authorization to Authenticated (Contributor+) Data Viewing and Deletion WP Mail Log <= 1.1.2	`CVE-2023-5644`	6.4 Medium	dc11	Yes
2023-11-20 00:00	WP Mail Log <= 1.1.2 - Authenticated (Contributor+) SQL Injection via id WP Mail Log <= 1.1.2	`CVE-2023-5674`	7.2 High	dc11	Yes
2023-07-18 00:00	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get WP Mail Log <= 1.0.2	`CVE-2023-33999`	6.1 Medium	Rafie Muhammad	Yes
2023-07-05 00:00	WP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email WP Mail Log <= 1.1.1	`CVE-2023-3088`	7.2 High	Alex Thomas	Yes
2022-12-02 00:00	WP Mail Log <= 1.0.1 - Cross-Site Request Forgery WP Mail Log <= 1.0.1	`CVE-2022-45807`	8.8 High	István Márton	Yes

Showing 1–8 of 8 reports

Latestv1.1.6

WP Mail Log

Author

WPVibes

4.9(66)

98/100

Last Updated

2026-06-30 (3mo ago)

Active Installs

10,000+

Downloads

139,523

Requires WP

5.0+

Requires PHP

7.4+

Tested up to

WP 7.0.4

Created

2009-09-01 (17y ago)

WP Mail Log is a WordPress plugin that allows you to easily log and view all emails that were sent from WordPress. This would be very useful for debugging email related problems in your WordPress site or for storing sent emails for auditing purposes, especially on eCommerce sites. Support If you have a question about the usage of the plugin or need help to troubleshoot, then post in WordPress forums. Other Plugins ✅ AnyWhere Elementor Pro: AnyWhere Elementor Pro comes with various creative dynamic content widgets that would enhance your Elementor Page Builder experience to build your dream website. ✅ Form Vibes: The ultimate tool to save and manage your Form submissions within WordPress Database. It also provides a graphical analytics report that allows you to visualize how different forms are performing. ✅ Elementor Addon Elements: With the help of Elementor Addon Elements, you can use rich and stunning widgets to build your dream website. ✅ Frontend Product Editor: Frontend product editor can be a great addition to your WooCommerce websites since it allows you to modify the WooCommerce product information right from the front. ✅ Content Lifecycle Manager: Content Lifecycle Manager helps you keep WordPress content accurate, up to date, and properly maintained over time.

View on WordPress.org