CVE-2026-8089
weMail < 2.1.3 - Reflected Cross-Site Scripting
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.
| Vendor | unknown |
| Product | wemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerce |
| Published | Jun 17, 2026 |
| Last Updated | Jun 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerce
Be the first to know when new high vulnerabilities affecting unknown wemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce
0 < 2.1.3
References
Credits
John Umoru WPScan