WordPress plugin
Mail logging & Catcher security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 7 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High4
- Medium3
- Low0
All Mail logging & Catcher vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure ≤2.2.0Update to 2.3.0 | CVE-2026-120040 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message ≤2.1.12Update to 2.2.0 | CVE-2026-93889 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤2.1.9Update to 2.1.10 | CVE-2024-47339 | |
| Medium4.3 | Cross-Site Request Forgery ≤2.1.6Update to 2.1.7 | CVE-2024-32099 | |
| Medium6.6 | Authenticated(Administrator+) SQL Injection <2.1.4Update to 2.1.4 | CVE-2023-50844 | |
| High7.2 | WP Mail Catcher <= 2.1.3 - Authenticated (Admin+) SQL Injection ≤2.1.3Update to 2.1.4 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Email Subject ≤2.1.2Update to 2.1.3 | CVE-2023-3080 |
- High7.5Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure
≤2.2.0Update to 2.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
≤2.1.12Update to 2.2.0
- Medium6.1Reflected Cross-Site Scripting
≤2.1.9Update to 2.1.10
- Medium4.3Cross-Site Request Forgery
≤2.1.6Update to 2.1.7
- Medium6.6Authenticated(Administrator+) SQL Injection
<2.1.4Update to 2.1.4
- High7.2WP Mail Catcher <= 2.1.3 - Authenticated (Admin+) SQL Injection
≤2.1.3Update to 2.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
≤2.1.2Update to 2.1.3
Mail logging & Catcher: common questions
Does Mail logging & Catcher have known vulnerabilities?
Yes. VulnCrest Radar lists 7 known vulnerabilities in Mail logging & Catcher: 4 high, 3 medium. None are known to affect version null.
How do I check which version of Mail logging & Catcher I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Mail logging & Catcher vulnerability?
CVE-2026-120040, published Oct 30, 2026: Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure. Severity: High (CVSS 7.5).
Is any Mail logging & Catcher vulnerability listed in CISA KEV?
No. None of the known Mail logging & Catcher vulnerabilities is currently listed in the CISA KEV catalog.