CVE-2021-46117: Jpress

High severity, CVSS 7.2. EPSS: 2.8% chance of exploitation in the next 30 days.

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.

Affected products

• Jpress Jpress: version 4.2.0 only

Published 2022-01-26. Last modified 2026-07-09.