CVE-2015-9496

HIGH 8.8CVE-2015-9496 · Published 22/10/2019 · updated 17/06/2026

In short

CVE-2015-9496 is a HIGH (CVSS 8.8) vulnerability affecting freshmail-newsletter (freshmail).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.4% of all vulnerabilities.
Fix: update to 1.6 or later.

Package	Affected versions	Patched versions
freshmail-newsletter freshmail	`< 1.6`	`1.6`

The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.