WordPress Plugin "Zoho Mail for WordPress" vulnerable to cross-site request forgery

CSIRTS triage

What

A cross-site request forgery vulnerability exists in the plugin.

Who is affected

Users of the Zoho Mail for WordPress plugin.

Urgency

Remediation is necessary to prevent unauthorized actions on behalf of users.

Action

Update to the latest version of the Zoho Mail for WordPress plugin.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

JVN (Japan Vulnerability Notes) (JP · national-cert · site)

Severity

unknown

Published

2026-06-03

Exploitation

Not in CISA KEV at last sync

Original advisory: https://jvn.jp/en/jp/JVN24733221/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-81740.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.

Referenced CVEs

Recent advisories for WordPress Plugin "Zoho

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• mediumCVE-2025-5017: The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQ…nvd · 2026-07-11

More from JVN (Japan Vulnerability Notes)

• unknownReflected cross-site scripting vulnerability in multiple laser printers and MFPs which implement Ricoh Web Ima…2026-07-09
• unknownMultiple vulnerabilities in the installer for Pupsman2026-07-08
• unknownApache Jena Fuseki vulnerable to path traversal2026-07-07
• unknownSEIKO EPSON printers and scanners Web Config vulnerable to cross-site request forgery2026-07-07
• unknownSeiko Solutions SkyBridge MB-A100/MB-A110 vulnerable to OS command injection2026-07-01