constantcontact vulnerabilities

Products

• creative mail 3
• constant contact forms 2
• Creative Mail – Easier WordPress & WooCommerce Email Marketing 1

Latest constantcontact CVEs

Newest publication first

1. CVE-2026-3985 Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter

   Published 2026-05-20

   High·CVSS 7.5 EPSS 0.40%

   The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of su...

2. CVE-2023-52208 WordPress Constant Contact Forms Plugin <= 2.4.2 is vulnerable to Sensitive Data Exposure

   Published 2024-01-08

   High·CVSS 7.5 EPSS 0.44%

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Constant Contact Constant Contact Forms.This issue affects Constant Contact Forms: from n/a through 2.4.2.

3. CVE-2022-44740 WordPress Creative Mail plugin <= 1.5.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

   Published 2022-11-18

   High·CVSS 8.8 EPSS 0.31%

   Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.

4. CVE-2022-40687 WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

   Published 2022-11-18

   High·CVSS 8.8 EPSS 0.77%

   Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

5. CVE-2022-40686 WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

   Published 2022-11-18

   High·CVSS 8.8 EPSS 0.29%

   Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

6. CVE-2021-24134 Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSS

   Published 2021-03-18

   Medium·CVSS 4.8 EPSS 0.65%

   Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts whe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.