CVE-2017-5942: An issue was discovered in the WP Mail plugin before 1.2 for WordPress.

Security readout for executives and security teams

CVE-2017-5942 is a reflected cross-site scripting issue in the WordPress WP Mail plugin before version 1.2. A crafted reply-to value while composing mail could cause JavaScript to run in the recipient user's browser context. Business urgency depends on whether legacy WordPress sites still use this plugin. Exposure is likely limited to WordPress sites that installed WP Mail plugin versions earlier than 1.2. The provided affected-products metadata is incomplete, so confirm by direct plugin inventory rather than CPE matching. Treat this as a targeted legacy WordPress hygiene item, not an emergency based on the provided evidence. Prioritize confirmation and upgrade or removal on externally exposed WordPress sites, especially where authenticated users handle mail workflows. Mitigation focus: Identify WordPress sites using the WP Mail plugin.; Upgrade WP Mail to version 1.2 or later if still installed.; Remove the plugin if it is unused or unsupported..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.