CVE-2026-1661
WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection
- State
- Published
- Severity
- 4.3 Medium
- Published
- Oct 2, 2026
- Updated
- Oct 2, 2026
- Reserved
- Jan 29, 2026
Description
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an administrator viewing the log and send their browser to an attacker-controlled page.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | WPScan |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
WP Mail LoggingUnknown |
|
References
- https://wpscan.com/vulnerability/dde19119-7ea8-4d02-bf89-7a6b0ca010b5/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.