CVE-2026-1661 — MEDIUM (4.3)

Vulnerability Description

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an administrator viewing the log and send their browser to an attacker-controlled page.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-79

References

https://wpscan.com/vulnerability/dde19119-7ea8-4d02-bf89-7a6b0ca010b5/

FAQ

What is CVE-2026-1661?

CVE-2026-1661 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject...

How severe is CVE-2026-1661?

CVE-2026-1661 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-1661?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.