Advisories · Technology

Rustaurius Ultimate WP Mail.

Every CVE that names Rustaurius Ultimate WP Mail among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-53454 CVE record

CVSS 6.5 Medium

WordPress Ultimate WP Mail Plugin <= 1.3.8 - Cross Site Scripting (XSS) Vulnerability
- Rustaurius Ultimate WP Mail
- Cross-site scripting (XSS)
Not analysed yet 22 Sept 2025
CVE-2025-6993 CVE record

CVSS 7.5 High

Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function
- rustaurius Ultimate WP Mail
- Broken access control
Not analysed yet 16 Jul 2025
CVE-2025-49288 CVE record

CVSS 8.8 High

WordPress Ultimate WP Mail plugin <= 1.3.5 - Account Takeover via Email Log Leak Vulnerability
- Rustaurius Ultimate WP Mail
- Broken access control
Not analysed yet 6 Jun 2025
CVE-2025-47490 CVE record

CVSS 8.5 High

WordPress Ultimate WP Mail plugin <= 1.3.4 - SQL Injection Vulnerability
- Rustaurius Ultimate WP Mail
- SQL injection
Not analysed yet 7 May 2025
CVE-2025-47466 CVE record

CVSS 5.4 Medium

WordPress Ultimate WP Mail plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability
- Rustaurius Ultimate WP Mail
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2025
CVE-2025-32694 CVE record

CVSS 4.7 Medium

WordPress Ultimate WP Mail plugin <= 1.3.10 - Open Redirection vulnerability
- Rustaurius Ultimate WP Mail
- Open redirect
Not analysed yet 9 Apr 2025