Elastic Email Sender Vulnerabilities

[en] Missing Authorization vulnerability in Elastic Email Elastic Email Sender elastic-email-sender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Sender: from n/a through <= 1.2.20.

Affected:

up to 1.2.20

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-66525 on NVD →

The Elastic Email Sender plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.2.20. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.2.20

Fixed in:

1.2.21

Disclosed:

Oct 28, 2025

CVE-2025-66525 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Elastic Email Sender plugin <= 1.2.6 versions.

Affected:

up to 1.2.7

Fixed in:

1.2.7

Disclosed:

Sep 3, 2023

CVE-2023-38387 on NVD →

The Elastic Email Sender plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in...

CVSS:

4.4

Affected:

up to 1.2.6

Fixed in:

1.2.7

Disclosed:

Jul 20, 2023

CVE-2023-38387 on NVD →