EUVD-2026-39734
GHSA-rq3h-6r32-7r52
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable reflected XSS needs no auth (PR:N) but requires victim click (UI:R); script crosses into browser context (S:C) with limited C/I/A impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions.
AnalysisAI
Reflected cross-site scripting in the weMail WordPress plugin (versions 2.1.2 and earlier) lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that the injected script runs in the WordPress site context, potentially affecting authenticated admin sessions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to click an attacker-crafted link (CVSS UI:R), so it cannot be triggered passively - the attacker must deliver the malicious URL via phishing or another social-engineering channel. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1 High) shows network-reachable, low-complexity, unauthenticated exploitation, but with the important caveat of UI:R - a victim must click an attacker-supplied link, which materially lowers real-world likelihood compared to a no-interaction flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL pointing at the vulnerable weMail endpoint with a malicious JavaScript payload embedded in a reflected parameter, then sends it to a WordPress administrator via phishing email or chat. When the admin clicks the link while logged in, the script executes in their authenticated session and can steal cookies, perform actions as the admin, or inject a rogue account. … |
| Remediation | Upgrade the weMail plugin to a release later than 2.1.2 once the vendor publishes a patched version; the available data does not list an exact fixed version, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wemail/vulnerability/wordpress-wemail-plugin-2-1-2-reflected-cross-site-scripting-xss-vulnerability) and the WordPress plugin changelog for the corrected build - No vendor-released patch version identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Audit all WordPress installations for weMail plugin versions ≤2.1.2; document affected sites and user count. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today