PLUGIN SECURITY
Is Mailpoet safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Mailpoet WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
mailpoet - Requires PHP: 7.4+
Known vulnerabilities
- MailPoet – Newsletters, Email Marketing, and Automation [mailpoet] < 3.23.2 [CVE-2019-11843, MailPoet – emails and newsletters in WordPress <= 3.23.1 - Reflected Cross-Site Scripting via URL parameter, MailPoet < 3.23.2 - Reflected Cross-Site Scripting Issue]
- MailPoet – Newsletters, Email Marketing, and Automation [mailpoet] < 5.3.2 [CVE-2024-10103, MailPoet <= 5.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting, WordPress MailPoet Plugin < 5.3.2 is vulnerable to Cross Site Scripting (XSS)]
- MailPoet – Newsletters, Email Marketing, and Automation [mailpoet] < 5.5.2 [CVE-2024-12743, WordPress MailPoet Plugin < 5.5.2 is vulnerable to Cross Site Scripting (XSS), EUVD-2025-15320, MailPoet <= 5.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- Hostinger Reach – AI-Powered Email Marketing for WordPress — 1000000+ active installs — max PHP 8.4
- Newsletter – Send awesome emails from WordPress — 200000+ active installs — max PHP 8.4
- Brevo – Email, SMS, Web Push, Chat, and more. — 100000+ active installs — max PHP 8.4
- Newsletters, Email Marketing, SMS and Popups by Omnisend — 100000+ active installs
- FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution — 80000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.