WordPress security by component

weMail

Plugin description

weMail is a WordPress component with 6 published CVE records in this archive. The latest tracked vulnerability was published Jun 26, 2026; the highest CVE/CNA score is 7.1.

Plugin slug: wemail

Latest vulnerability

CVE-2026-57322: weMail: Cross-site scripting

weMail is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.1.2.

PublishedJun 26, 2026

Known safe version2.1.3

		Safe version
Jun 26, 2026	CVE-2026-57322 weMail: Cross-site scripting weMail is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.1.2.	2.1.3	CVE7.1 NVDPending
Feb 21, 2026	CVE-2025-14339 weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation: A security weakness weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVDPending
Jan 20, 2026	CVE-2025-14348 weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation: A security weakness weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
May 07, 2025	CVE-2025-47540 weMail: A security weakness weMail is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD7.5
Aug 18, 2024	CVE-2024-43238 weMail: Cross-site scripting weMail is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVD6.1
Jun 11, 2024	CVE-2024-34822 weMail: A security weakness weMail is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD5.3