WP Mailster

WP Mailster has 18 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 18 are fixed as of October 2026. Their average CVSS score is 6.5, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 5 high. 2024 was the busiest year with 10 disclosures.

The most common weakness is Cross-Site Scripting, behind 8 of the records (44%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Missing Authorization.

Every one of the 18 issues recorded for WP Mailster has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, most of them (4) reported by Kévin Mosbahi (Mika). WP Mailster is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891001.01.2017Today05.12.20176.1WP Mailster < 1.5.5 - Cross-Site Scripting CVSS 6.1 · 05.12.201723.11.20246.1WP Mailster <= 1.8.15.0 - Reflected Cross-Site Scripting CVSS 6.1 · 23.11.20246.4WP Mailster <= 1.8.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 23.11.202402.12.20246.5WP Mailster <= 1.8.16.0 - Missing Authorization CVSS 6.5 · 02.12.20245.3WP Mailster <= 1.8.16.0 - Unauthenticated Information Exposure CVSS 5.3 · 02.12.20248.8WP Mailster <= 1.8.16.0 - Authenticated (Contributor+) SQL Injection via orderby CVSS 8.8 · 02.12.20247.5WP Mailster <= 1.8.16.0 - Missing Authorization CVSS 7.5 · 02.12.20246.4WP Mailster <= 1.8.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 02.12.202407.12.20245.3WP Mailster <= 1.8.16.0 - Unauthenticated Sensitive Information Exposure CVSS 5.3 · 07.12.202411.12.20244.3WP Mailster <= 1.8.17.0 - Cross-Site Request Forgery CVSS 4.3 · 11.12.202422.12.20246.1WP Mailster <= 1.8.17.0 - Reflected Cross-Site Scripting CVSS 6.1 · 22.12.202406.01.20255.3WP Mailster <= 1.8.17.0 - Unauthenticated Sensitive Information Exposure CVSS 5.3 · 06.01.202528.01.20256.1WP Mailster <= 1.8.20.0 - Reflected Cross-Site Scripting CVSS 6.1 · 28.01.202505.10.20264.3WP Mailster <= 1.9.0.0 - Missing Authorization CVSS 4.3 · 05.10.20267.2WP Mailster <= 1.9.0.0 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 05.10.202619.10.20267.5WP Mailster <= 1.9.1.0 - Authenticated (Contributor+) Local File Inclusion CVSS 7.5 · 19.10.20269.8WP Mailster <= 1.9.1.0 - Unauthenticated Arbitrary File Upload CVSS 9.8 · 19.10.202620.10.20267.2WP Mailster <= 1.9.1.0 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 20.10.2026

Strategic Overview

Avg CVSSMedium
6.5/ 10
Patch Coverage100%
Open

0

Fixed

18

Get automatic notifications for all WP Mailster vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-111832

WP Mailster <= 1.9.1.0 - Unauthenticated Arbitrary File Upload

Read the full analysis

Vulnerability Records

18 records
WP Mailster banner
Latestv1.9.2.0

WP Mailster

brandtoss

Author

brandtoss

4.9(32)
98/100
Last Updated
2026-10-18 (10d ago)
Active Installs
300+
Downloads
34,892
Requires WP
5.3+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2017-01-01 (10y ago)

True two-way group communication over email WP Mailster allows your users to be part of a group and communicate by email without having to log into a website. Similar to programs like Mailman or Listserv this plugin allows you to run a discussion mailing list. That means that every email sent to a central email address is forwarded to the rest of the members of the list. When members reply to such list emails WP Mailster again forwards them to the other list recipients. Unlike newsletter plugins this allows true two-way communication via email. Features group communication through email usable with any POP3/IMAP email account recipients can be managed in the WordPress admin area users can subscribe/unsubscribe through widgets on the website all WP users can be chosen as recipients, additional recipients can be stored (without having to create them as WP users) users can be organized in groups single users or whole groups can be added as recipients of a mailing list replies to mailing list messages can be forwarded to all recipients (or only the sender) email archive for browsing the mails full support of HTML emails and attachments custom headers and footers subject prefixes many more features Note: This version of WP Mailster is FREE and limited in terms of number of lists and subscribers per list. Additional features such as captcha protection, double opt-in, email filtering, configurable event notifications, and many others are available in the premium editions. Help & Support Please check the documentation on our site as well as look through the FAQs before contacting us. Thank you! Special Thanks This plugin has been tested on various browsers thanks to BrowserStack!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C