WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Email Template Designer – WP HTML Mail

All in one email template designer for WooCommerce, Ninja Forms, Elementor Forms, Gravity Forms, CF7, Support Plus, EDD, ...

5Reported vulnerabilities
8.8Highest CVSS score
3.4.9Latest version
20,000+Active installs

What to do now

Update Email Template Designer – WP HTML Mail to 3.4.1 or later. 5 of these have a fixed version available. Updating resolves them.

Plugin last updated: March 4, 2025 / Tested up to WordPress: 6.7.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2022-0218 Medium 6.1 70.5% 3.0.9 and earlier 3.1 February 4, 2022
CVE-2019-25148 Medium 6.1 0.7% Before 2.9.1 2.9.1 June 7, 2023
CVE-2019-25144 Medium 6.1 0.6% 2.2.10 and earlier 2.2.11 June 7, 2023
CVE-2021-20779 High 8.8 0.9% Before 3.0.8 3.0.8 July 7, 2021
CVE-2023-40202 Medium 4.3 0.2% 3.4.0 and earlier 3.4.1 August 11, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.