CVE-2017-5942: Wp Mail Project Wp Mail

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected XSS. This would allow you to execute JavaScript in the context of the user receiving the mail.

Affected products

• Wp Mail Project Wp Mail: up to and including 1.1

Published 2017-02-10. Last modified 2026-06-17.