WordPress plugin
Emails Catch All security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 1 known vulnerability is fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium0
- Low0
All Emails Catch All vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Subscriber+) Information Exposure to Password Reset and Privilege Escalation ≤3.5.3Update to 3.5.4 | CVE-2025-60041 |
- High8.8Authenticated (Subscriber+) Information Exposure to Password Reset and Privilege Escalation
≤3.5.3Update to 3.5.4
Emails Catch All: common questions
Does Emails Catch All have known vulnerabilities?
Yes. VulnCrest Radar lists 1 known vulnerability in Emails Catch All: 1 high. None are known to affect version null.
How do I check which version of Emails Catch All I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Emails Catch All vulnerability?
CVE-2025-60041, published Oct 11, 2025: Emails Catch <= 3.5.3 - Authenticated (Subscriber+) Information Exposure to Password Reset and Privilege Escalation. Severity: High (CVSS 8.8).
Is any Emails Catch All vulnerability listed in CISA KEV?
No. None of the known Emails Catch All vulnerabilities is currently listed in the CISA KEV catalog.