WP Test Email

WP Test Email has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

3 independent researchers contributed these findings, one record each. WP Test Email is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.6.7.

Strategic Overview

Avg CVSSMedium

6.5/ 10

Patch Coverage67%

Open

Fixed

Get automatic notifications for all WP Test Email vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2025-69102

Test Email <= 1.1.7 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records


2026-01-15 00:00	Test Email <= 1.1.7 - Reflected Cross-Site Scripting WP Test Email <= 1.1.7	`CVE-2025-69102`	6.1 Medium	Ryan Novotny	No
2025-03-14 00:00	WP Test Email <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting WP Test Email <= 1.1.8	`CVE-2025-2325`	7.2 High	Silent Breach	Yes
2024-09-12 18:16	WP Test Email <= 1.1.7 - Reflected Cross-Site Scripting WP Test Email <= 1.1.7	`CVE-2024-8664`	6.1 Medium	vgo0	Yes

Showing 1–3 of 3 reports

Latestv1.1.7

WP Test Email

Author

Boopathi Rajan

4.7(15)

94/100

Last Updated

2024-07-31 (2y ago)

Active Installs

20,000+

Downloads

260,023

Requires WP

4.3+

Requires PHP

5.2.4+

Tested up to

WP 6.6.7

Created

2018-10-28 (8y ago)

Do you want to test whether the WordPress installation is sending mail or not? WP Test Email helps you to do that. It allows you to send a simple test email to an email address of your choice and logs all outgoing emails. Note: The email logs are retained for a maximum of 30 days. Older logs are automatically removed to keep the log table manageable. Kindly let us know your feedback or comments to add more features to this plugin.

View on WordPress.org