CVE-2026-8174

MediumCVSS 5.7/10Last modified Jul 23, 2026

Description

Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF).

This issue affects Zoho Mail wordpress plugin versions before 1.6.2.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
ZohocorpZoho Mail wordpress plugin< 1.6.2

References

Timeline

Published
May 26, 2026
Last modified
Jul 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-817405.3The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment providerCVE-2026-817414.7The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its emailCVE-2026-817428.8The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, uCVE-2026-817437.5Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filCVE-2026-817446.5Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated atCVE-2026-81759.8IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix PacCVE-2026-817535.1Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled maCVE-2026-817547.2The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site ScrCVE-2026-817557.5Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust serveCVE-2026-817569.3Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.CVE-2026-817577.2Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.CVE-2026-817586.3Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.
CVE-2026-8174: Medium severity, CVSS 5.7 | Vulnix