WP-EMail · Security record
Is WP-EMail safe?
No known vulnerability affects the current version (3.0.0). 8 issues were found in earlier versions and fixed, the latest disclosed on Jul 24, 2023.
Checked 2 days ago against the WPVulnerability database, for version 3.0.0.
How it’s looked after
- Last release
- Aug 10, 2026 (2 months ago)
- Releases in the last year
- 2
- Tested up to
- WordPress 7.0.8
- Active installs
- 1K+
8 known vulnerabilities
- 1 high
- 2 medium
- 5 not rated
None affects the current version.
Disclosed each year
- 20163
- 20222
- 20231
Every known vulnerability in WP-EMail
Newest first, with any that affect the current version at the top.
Fixed in 2.69.1 · CVE-2023-3721 · Jul 24, 2023 · Wordfence
Fixed in 2.69.0 · CVE-2022-1614 · May 30, 2022 · Wordfence
Fixed in 2.69.0 · CVE-2022-1630 · May 30, 2022 · Wordfence
Fixed in 2.67.3 · Jul 7, 2016 · Wordfence
Fixed in 2.67.3 · Jul 7, 2016 · Patchstack
Fixed in 2.67.2 · May 14, 2016 · Wordfence
Fixed in 2.67.2 · WPScan
Fixed in 2.67.3 · WPScan
Questions about WP-EMail’s security
Is WP-EMail safe to use?
No known vulnerability affects its current version. Earlier versions had issues that are now fixed, so keep WP-EMail updated: most attacks target sites that haven’t updated.
Does WP-EMail have known security vulnerabilities?
None that affect the current version. WPVulnerability’s database lists 8 older issues, fixed in earlier versions, so keep WP-EMail up to date.
Is WP-EMail still maintained?
Yes. Its last release was 2 months ago. No support threads were opened in the last two months.
Is WP-EMail compatible with the latest WordPress?
It’s tested up to WordPress 7.0.8, one version behind the current 7.1. Authors often update this line a few weeks after a release.
Hear about the next one first
Track your plugin on TrackWP and get an alert when a new vulnerability affecting it is published. Every plan has it, the free Starter too; Boost and FullCharge email it at once.
Start freeVulnerability data from WPVulnerability (CC0), which gathers records from CVE, Wordfence, Patchstack and WPScan. A clean record isn’t a guarantee: keep every plugin updated.