Stored Cross-Site Scripting Vulnerability in Mail Logging Plugin for WordPress

CVE-2026-93889

What is CVE-2026-93889?

The Mail Logging - WP Mail Catcher plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in its handling of PHPMailer's 'wp_mail_failed' error messages. This issue can be exploited by unauthenticated attackers when a separately installed plugin, such as Contact Form 7, transmits user-controlled data into mail fields. The vulnerabilities allow attackers to inject arbitrary scripts into web pages, which may execute for users accessing those pages.

References