Known vulnerabilities in Brevo – Email, SMS, Web Push, Chat, and more.

Turn your WordPress site into a marketing powerhouse. Grow your audience, boost engagement, and drive more sales with Brevo.

9Reported vulnerabilities

7.2Highest CVSS score

3.3.5Latest version

100,000+Active installs

What to do now

Update Brevo – Email, SMS, Web Push, Chat, and more. to 3.1.78 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 24, 2026 / Tested up to WordPress: 6.9.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2021-24874	Medium 6.1	0.8%	Before 3.1.31	`3.1.31`	February 14, 2022
CVE-2021-24923	Medium 6.1	0.8%	Before 3.1.25	`3.1.25`	January 24, 2022
CVE-2023-2472	Medium 6.1	0.5%	Before 3.1.61	`3.1.61`	June 5, 2023
WF-86f7eb83-8483-4c6b-993e-ce11084241e8	High 7.2	—	3.1.39 and earlier	`3.1.40`	April 8, 2022
CVE-2025-14799	Medium 6.5	0.5%	0 to 3.3.0 (inclusive)	`3.3.1`	February 18, 2026
CVE-2026-15297	Medium 6.1	0.4%	0 to 3.1.77 (inclusive)	`3.1.78`	July 10, 2026
CVE-2024-35668	Medium 6.1	0.3%	3.1.77 and earlier	`3.1.78`	June 3, 2024
CVE-2024-8477	Medium 4.3	0.2%	Before 3.1.88	`3.1.88`	October 10, 2024
CVE-2024-43287	Medium 4.3	0.2%	3.1.82 and earlier	`3.1.83`	August 16, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.