CVE-2026-105061
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) vulnerability in WP Mailster up to version 1.9.0.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
Risk Assessment
An attacker could steal user sessions, take over accounts, or spread malicious content.
Recommendation
Update the WP Mailster plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in WP Mailster
See all- CVE-2026-111829Medium
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.
- CVE-2026-105055Medium
Missing authorization in WP Mailster plugin up to version 1.9.0.0. Allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS