Check Email Vulnerabilities

The Check & Log Email plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.0.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access...

CVSS:

4.9

Affected:

up to 2.0.14

Fixed in:

2.0.15

Disclosed:

Jul 13, 2026

CVE-2026-14554 on NVD →

The Check & Log Email – Easy Email Testing & Mail logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 2.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVSS:

7.2

Affected:

up to 2.0.13

Fixed in:

2.0.13

Disclosed:

Apr 28, 2026

CVE-2026-5306 on NVD →

The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes...

CVSS:

8.1

Affected:

up to 1.0.9

Fixed in:

1.0.10

Disclosed:

Mar 25, 2024

CVE-2024-0866 on NVD →

The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

CVSS:

6.1

Affected:

up to 1.0.5

Fixed in:

1.0.6

Disclosed:

May 2, 2022

CVE-2022-1547 on NVD →

The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

CVSS:

6.1

Affected:

up to 1.0.4

Fixed in:

1.0.4

Disclosed:

Nov 1, 2021

CVE-2021-24908 on NVD →

The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues

CVSS:

7.2

Affected:

up to 1.0.2

Fixed in:

1.0.3

Disclosed:

Sep 27, 2021

CVE-2021-24774 on NVD →

The check-email plugin before 0.5.2 for WordPress has XSS via several vulnerable parameters in the check-email/check-email.php file.

CVSS:

6.1

Affected:

up to 0.5.2

Fixed in:

0.5.2

Disclosed:

Nov 12, 2016

CVE-2016-10934 on NVD →