MailerPress vulnerabilities
3 known CVE vulnerabilities in MailerPress, translated and rated.
- CVE-2026-18437Medium
The MailerPress plugin for WordPress up to version 1.5.0 is vulnerable to unauthorized access due to a missing capability check on the REST API endpoint `mailerpress/v1/contact`. This allows unauthenticated attackers to update contact details.
- CVE-2026-57410High
The MailerPress plugin up to version 2.0.2 contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this flaw to gain higher privileges within the system.
- CVE-2026-8599Medium
The MailerPress plugin for WordPress up to version 2.0.4 is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. The public campaign preview endpoint (/mp-email/{id}-slug/) is not affected due to a Content-Security-Policy header blocking inline scripts; exploitation is limited to the admin dashboard preview.