Automattic Mailpoet vulnerabilities

3 CVEs affecting Automattic Mailpoet, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-12743, published 2025-05-15.

More from Automattic.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-11843, published 2020-06-02. Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days. The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).
• CVE-2024-12743, published 2025-05-15. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even…
• CVE-2024-10103, published 2024-11-19. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which…