CVE-2021-46114: Jpress

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.

Affected products

• Jpress Jpress: version 4.2.0 only

Published 2022-01-26. Last modified 2026-07-09.