CVE-2026-8174

MediumCVSS 5.7/10Last modified Jul 23, 2026

Description

Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF).

This issue affects Zoho Mail wordpress plugin versions before 1.6.2.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
May 26, 2026
Last modified
Jul 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-817405.3The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment providerCVE-2026-817414.7The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its emailCVE-2026-817428.8The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, uCVE-2026-817437.5Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filCVE-2026-81759.8IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix PacCVE-2026-817535.1Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled maCVE-2026-817547.2The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site ScrCVE-2026-81755Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust serveCVE-2026-817569.3Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.CVE-2026-817577.2Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.CVE-2026-817586.3Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.CVE-2026-817595.4Contributor Broken Access Control in WpEvently <= 5.5.0 versions.
CVE-2026-8174: Medium severity, CVSS 5.7 | Vulnix