CVE-2026-93889Published
Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-93889 · Microsoft / collected KEV context
cve-program · CVE-2026-93889
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1d9d03-0216-484c-85ca-73f157595713?source=cve
- https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.1.12/src/Loggers/LogHelper.php#L69
- https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.1.12/src/Views/LogModal.php#L83
- https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.1.12/src/Loggers/WpMail.php#L30
- https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.1.12/src/MailAdminTable.php#L149
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3717442%40wp-mail-catcher&new=3717442%40wp-mail-catcher
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.