Mailing Group Listserv
Mailing Group Listserv has 4 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; 3 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 6.5 out of 10. 2025 was the busiest year with 4 disclosures.
The most common weakness is SQL Injection, behind 2 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.
3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
4 independent researchers contributed these findings, one record each. Mailing Group Listserv is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-50036Mailing Group Listserv <= 3.0.5 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

Mailing Group Listserv
Author
Yamna Khawaja
The Mailing Group Listserv plugin allows you to run a Mailing Group, also known as a Listserv, right from your WordPress website. You can sign up your users, friends, family etc, directly from your WordPress administration area, and they can then all exchange emails via their favourite email software, no need to login to wordpress dashboard. It has very easy to use intuitive interface and advanced debugging functions. This is NOT a one-way Announcement list where only YOU can email everyone else. Its a Two-Way mailing group just like Yahoo Groups, Google Groups etc (provides most functions of those groups but not all). It can be used as a partial alternative to php List and mailman. Its a wonderful wordpress group plugin to help you and your groups stay connected! – Premium version includes message moderation and archives. Premium version offers Email message archives where so you can see all messages sent to mailing group in these archives. Users can also see archives of their groups. Pro version also supports email moderation. Free Version – Features Shortcode for display of sign-up form Customisable CSS for sign-up form to match your website design Double opt-in via email or direct member addition Public, Invitation-only and Private group settings Add members from WordPress User list Import members from external .CSV file Optional email alert to administrator when new member applications come in ADVANCED AND EASY TROUBLESHOOTING FOR IMAP. Test connection button shows all debuggin information Ability to send emails using 3 options, php, wp_mail and smtp. Allows email attachments. Prefix email subject lines with group name. Customizeable group email footer. Get Started now with these quick installation steps or watch video below: https://www.wpmailinggroup.com/faq/quick-start-in-6-steps/ Pro Version – WordPress Mailing Group Listserv Plugin Features The [WPMG](https://www.wpmailinggroup.com/) Pro plugin has several extra features other than all features of free plugin: *Unlimited mailing groups per domain name. *Unlimited members per mailing group. *Original Sender email can be shown in group email footer from group settings page. *Group administrator can choose what to set as “reply to” email for group. This means that when members reply to group emails using their email clients, it either goes to whole group, a custom email or original sender only. *Wordpress Mailing Group Pro has message moderation & archive functionality. *Quick Premium support for plugin initial setup. *Shortcode for displaying emails from any mailing group on frontend. *Application for multiple mailing groups from one sign-up form. *Support and new feature requests. *Allows email attachments. Ability to restrict size of email attachments *Email digest option mailing groups *Create WPMG API using action hooks in WPMG Pro. All emails which are sent to mailing groups can be sent to external webhook or API *NOW PHP 7 COMPATIBLE, DEMO AVAILABLE ON PREMIUM PLUGIN SITE www.WPMailingGroup.com See WPMG Premium Official Site for FAQs and more.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C