WordPress Plugin Vulnerabilities

Test Email <= 1.1.7 - Reflected Cross-Site Scripting

Description

The Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
wp-test-email
No known fix

References

CVE
CVE-2025-69102
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c664b4e5-8f9f-4cbd-86a6-74901fa47223

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Ryan Novotny
Verified
No
WPVDB ID
01f27b03-5306-4c2b-91af-ad134ed54fcc

Timeline

Publicly Published
2026-01-15 (about 8 months ago)
Added
2026-01-19 (about 8 months ago)
Last Updated
2026-01-19 (about 8 months ago)

Other

Published
Title
Published
2013-08-26
Title
Contact Form 3.34 - contact_form.php cntctfrm_contact_message Parameter XSS
Published
2021-12-01
Title
Variation Swatches for WooCommerce < 2.1.2 - Subscriber+ Stored Cross-Site Scripting
Published
2025-07-15
Title
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations < 2.0.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-07-03
Title
Auto Location for WP Job Manager via Google < 1.1 - Admin+ Cross Site Scripting
Published
2025-08-25
Title
Goal Tracker for Patreon <= 0.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting