Advisories · Technology

Zoho Mail Zoho ZeptoMail.

Every CVE that names Zoho Mail Zoho ZeptoMail among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-67972 CVE record

CVSS 4.3 Medium

WordPress Zoho ZeptoMail plugin <= 3.2.9 - Broken Access Control vulnerability
- Zoho Mail Zoho ZeptoMail
- Broken access control
Not analysed yet 20 Feb 2026
CVE-2025-49028 CVE record

CVSS 7.1 High

WordPress Zoho ZeptoMail plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
- Zoho Mail Zoho ZeptoMail
- Cross-site request forgery (CSRF)
Not analysed yet 31 Dec 2025