Zoho Mail vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Zoho Mail products: 2 record(s), with severity, exploitation and fixes.

Zoho ZeptoMail 2

Exploited only (KEV) →

CVE-2025-67972 Medium · 4.3 CWE-862 Feb 20, 2026

WordPress Zoho ZeptoMail plugin <= 3.2.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zoho ZeptoMail: from n/a through 3.2.9.

CVE-2025-49028 High · 7.1 CWE-352 Dec 31, 2025

WordPress Zoho ZeptoMail plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Zoho Mail Zoho ZeptoMail transmail allows Stored XSS.This issue affects Zoho ZeptoMail: from n/a through <= 3.3.1.