Medium 4.4
2026-01-17< 1.6.3
CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter
Minimum safe version
1.6.3
Update to 1.6.3 or later to address 5 fixable vulnerabilities
CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter
CVE-2025-24694
CVE-2025-24758
CVE-2024-11202
WordPress CM Email Registration Blacklist and Whitelist Plugin < 1.4.9 is vulnerable to Cross Site Request Forgery (CSRF)