Plugin icon

Ultimate WP Mail

ultimate-wp-mail

Vulnerabilities:

6

Last Updated:

May 18, 2026

Active Installs:

800

Published
Title
Fixed in
CVSS
Published
2025-09-22
Title
Ultimate WP Mail < 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.9
CVSS
6.4 (medium)
Published
2025-07-15
Title
Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function
Fixed in
Fixed in 1.3.7
CVSS
7.5 (high)
Published
2025-06-05
Title
Ultimate WP Mail < 1.3.6 - Missing Authorization
Fixed in
Fixed in 1.3.6
CVSS
4.3 (medium)
Published
2025-05-07
Title
Ultimate WP Mail < 1.3.5 - Cross-Site Request Forgery
Fixed in
Fixed in 1.3.5
CVSS
4.3 (medium)
Published
2025-05-07
Title
Ultimate WP Mail < 1.3.5 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 1.3.5
CVSS
6.5 (medium)
Published
2025-04-09
Title
Ultimate WP Mail <= 1.3.9 - Open Redirect
Fixed in
No known fix
CVSS
6.1 (medium)