# org.jenkins-ci.plugins:email-ext (Maven) vulnerabilities 12 known vulnerabilities (1 critical, 1 high, 4 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Dependents: 1 - Registry: https://central.sonatype.com/artifact/org.jenkins-ci.plugins/email-ext ## Advisories (12) ### [CVE-2026-48920](https://cve.now/CVE-2026-48920): Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as \`base64\` in email content by setting the… - Severity: High 8.8 - Published: May 27, 2026 - Affected: fixed in 1933.1935.v276319e3cc47. ### [CVE-2023-32980](https://cve.now/CVE-2023-32980): A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an… - Severity: Medium 4.3 - Published: May 16, 2023 - Affected: fixed in 2.96.1. ### [CVE-2023-32979](https://cve.now/CVE-2023-32979): Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with… - Severity: Medium 4.3 - Published: May 16, 2023 - Affected: fixed in 2.96.1. ### [CVE-2023-25765](https://cve.now/CVE-2023-25765): In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection… - Severity: Critical 9.9 - Published: Feb 15, 2023 - Affected: fixed in 2.94. ### [CVE-2023-25764](https://cve.now/CVE-2023-25764): Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output… - Severity: Medium 5.4 - Published: Feb 15, 2023 - Affected: fixed in 2.94. ### [CVE-2023-25763](https://cve.now/CVE-2023-25763): Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored… - Severity: Medium 5.4 - Published: Feb 15, 2023 - Affected: fixed in 2.94. ### [CVE-2020-2253](https://cve.now/CVE-2020-2253): Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. - Severity: Unrated - Published: Sep 16, 2020 - Affected: fixed in 2.76. ### [CVE-2020-2232](https://cve.now/CVE-2020-2232): Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins… - Severity: Unrated - Published: Aug 12, 2020 - Affected: from 2.72, fixed in 2.74. ### [CVE-2019-1003032](https://cve.now/CVE-2019-1003032): A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml… - Severity: Unrated - Published: Mar 8, 2019 - Affected: fixed in 2.65. ### [CVE-2018-1000417](https://cve.now/CVE-2018-1000417): A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in… - Severity: Unrated - Published: Jan 9, 2019 - Affected: fixed in 1.1. ### [CVE-2017-2654](https://cve.now/CVE-2017-2654): jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. - Severity: Low 3.7 - Published: Aug 6, 2018 - Affected: fixed in 2.57.1. ### [CVE-2018-1000176](https://cve.now/CVE-2018-1000176): An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in… - Severity: Unrated - Published: May 8, 2018 - Affected: fixed in 2.62. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.jenkins-ci.plugins:email-ext Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.