CVE-2026-8089
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.
- Score
- CVSS 3.1 7.1 High
- Status
- Deferred - contact@wpscan.com
- Published
- 2026-06-17
- Last modified
- 2026-06-17
- Weaknesses
- CWE-79
Affected products
- Email Automation (Unknown)
- Newsletters (Unknown)
- Subscribers Email Optins For Woocommerce (Unknown)
- Wemail Email Marketing (Unknown)
References
- https://wpscan.com/vulnerability/f00c1853-a4b2-4e91-99b3-fed8acbe6da7/
