CVE-2026-93889

Name of the Vulnerable Software and Affected Versions Mail logging – WP Mail Catcher versions prior to 2.1.13

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs via the PHPMailer wp mail failed error message, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. Exploitation requires a separate plugin, such as Contact Form 7, to pass unauthenticated user-controlled input into mail fields that PHPMailer includes in its failure error message.

Recommendations Update to a version newer than 2.1.12.